CVE-2019-0337 Cross-site scripting in SAP NetWeaver Process Integration (Java Proxy Runtime)

What is CVE-2019-0337?

CVE-2019-0337 is a medium-severity cross-site scripting vulnerability in SAP NetWeaver Process Integration (Java Proxy Runtime), published on 14 Aug 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting (XSS) vulnerability

Weakness: CWE-79

Which versions are affected by CVE-2019-0337?

It affects 1 product.

Products include Sap Netweaver Process Integration.

How do I fix CVE-2019-0337?

No fix has been published for CVE-2019-0337 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-0337 being exploited?

There is no known exploitation of CVE-2019-0337 in the wild and no public exploit code.

Other vulnerabilities in SAP NetWeaver Process Integration (Java Proxy Runtime)

• CVE-2022-41272 Missing authorization in NetWeaver Process Integration Critical 9.9
• CVE-2022-41271 SQL injection in NetWeaver Process Integration Critical 9.4
• CVE-2021-27604 XML external entity in SAP Process Integration (Enterprise Service Repository JAVA Mappings) High 7.7
• CVE-2019-0315 Information disclosure in SAP NetWeaver Process Integration(SAP XIESR) High 7.5
• CVE-2019-0328 Command injection in SAP NetWeaver Process Integration ABAP tests (SAP Basis) High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c356-2qc6-xmc3.