CVE-2019-0356 Information disclosure in SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP XIAF
An attacker can access restricted information in SAP NetWeaver Process Integration Runtime Workbench, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-0356?
CVE-2019-0356 is a medium-severity vulnerability in SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF, published on 10 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.
Which versions are affected by CVE-2019-0356?
It affects 1 product.
Products include Sap Netweaver Process Integration.
How do I fix CVE-2019-0356?
No fix has been published for CVE-2019-0356 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-0356 being exploited?
There is no known exploitation of CVE-2019-0356 in the wild and no public exploit code.
Other vulnerabilities in SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF
- CVE-2022-41272 Missing authorization in NetWeaver Process Integration
- CVE-2022-41271 SQL injection in NetWeaver Process Integration
- CVE-2021-27604 XML external entity in SAP Process Integration (Enterprise Service Repository JAVA Mappings)
- CVE-2019-0315 Information disclosure in SAP NetWeaver Process Integration(SAP XIESR)
- CVE-2019-0328 Command injection in SAP NetWeaver Process Integration ABAP tests (SAP Basis)
Sources
Also known as GHSA-h3r6-5qmm-j4fh.