CVE-2019-0367 Missing authorization in SAP NetWeaver Process Integration (B2B Toolkit)
An authenticated user can import B2B table content without proper authorization checks, potentially modifying data in SAP NetWeaver Process Integration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-0367?
CVE-2019-0367 is a medium-severity missing authorization vulnerability in SAP NetWeaver Process Integration (B2B Toolkit), published on 8 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.
Weakness: CWE-862
Which versions are affected by CVE-2019-0367?
It affects 1 product.
Products include Sap Netweaver Process Integration.
How do I fix CVE-2019-0367?
No fix has been published for CVE-2019-0367 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-0367 being exploited?
There is no known exploitation of CVE-2019-0367 in the wild and no public exploit code.
Other vulnerabilities in SAP NetWeaver Process Integration (B2B Toolkit)
- CVE-2022-41272 Missing authorization in NetWeaver Process Integration
- CVE-2022-41271 SQL injection in NetWeaver Process Integration
- CVE-2021-27604 XML external entity in SAP Process Integration (Enterprise Service Repository JAVA Mappings)
- CVE-2019-0315 Information disclosure in SAP NetWeaver Process Integration(SAP XIESR)
- CVE-2019-0328 Command injection in SAP NetWeaver Process Integration ABAP tests (SAP Basis)
Sources
Also known as GHSA-fwjq-4h8x-3j22.