CVE-2019-0267 Cross-site request forgery in SAP Manufacturing Integration and Intelligence
Attackers can perform cross-site request forgery attacks against the Illuminator Servlet due to missing anti-XSRF tokens.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-0267?
CVE-2019-0267 is a high-severity vulnerability in SAP Manufacturing Integration and Intelligence, published on 15 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens. This might lead to XSRF attacks in case the data is being posted to the Servlet from an external application.
Weakness: CWE-352
Which versions are affected by CVE-2019-0267?
It affects 1 product.
Products include Sap Manufacturing Integration and Intelligence.
How do I fix CVE-2019-0267?
No fix has been published for CVE-2019-0267 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-0267 being exploited?
There is no known exploitation of CVE-2019-0267 in the wild and no public exploit code.
Other vulnerabilities in SAP Manufacturing Integration and Intelligence
Sources
Also known as GHSA-x27f-w33x-pqqr.