CVE Vulnerabilities

CVE-2019-0304

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Jun 12, 2019 | Modified: Jul 21, 2021
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Advanced_business_application_programming_platform_kernel Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_kernel Sap 7.45 (including) 7.45 (including)
Advanced_business_application_programming_platform_kernel Sap 7.49 (including) 7.49 (including)
Advanced_business_application_programming_platform_kernel Sap 7.53 (including) 7.53 (including)
Advanced_business_application_programming_platform_kernel Sap 7.73 (including) 7.73 (including)
Advanced_business_application_programming_platform_krnl32nuc Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_krnl32nuc Sap 7.21ext (including) 7.21ext (including)
Advanced_business_application_programming_platform_krnl32nuc Sap 7.22 (including) 7.22 (including)
Advanced_business_application_programming_platform_krnl32nuc Sap 7.22ext (including) 7.22ext (including)
Advanced_business_application_programming_platform_krnl32uc Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_krnl32uc Sap 7.21ext (including) 7.21ext (including)
Advanced_business_application_programming_platform_krnl32uc Sap 7.22 (including) 7.22 (including)
Advanced_business_application_programming_platform_krnl32uc Sap 7.22ext (including) 7.22ext (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.21ext (including) 7.21ext (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.22 (including) 7.22 (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.22ext (including) 7.22ext (including)
Advanced_business_application_programming_platform_krnl64nuc Sap 7.49 (including) 7.49 (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.21 (including) 7.21 (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.21ext (including) 7.21ext (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.22 (including) 7.22 (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.22ext (including) 7.22ext (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.49 (including) 7.49 (including)
Advanced_business_application_programming_platform_krnl64uc Sap 7.73 (including) 7.73 (including)

Potential Mitigations

References