CVE-2019-0298

Опубликовано: 14 мая 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54.

Ссылки

http://www.securityfocus.com/bid/108314
Third Party Advisory
VDB Entry
https://launchpad.support.sap.com/#/notes/2773086
Permissions Required
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032
Vendor Advisory
http://www.securityfocus.com/bid/108314
Third Party Advisory
VDB Entry
https://launchpad.support.sap.com/#/notes/2773086
Permissions Required
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sap:e-commerce:7.30:*:*:*:*:*:*:*

cpe:2.3:a:sap:e-commerce:7.31:*:*:*:*:*:*:*

cpe:2.3:a:sap:e-commerce:7.32:*:*:*:*:*:*:*

cpe:2.3:a:sap:e-commerce:7.33:*:*:*:*:*:*:*

cpe:2.3:a:sap:e-commerce:7.54:*:*:*:*:*:*:*

EPSS

Процентиль: 52%

0.00293

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-qp4x-8h8x-vr88