Vulnerability Details : CVE-2019-0283
SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document.
Products affected by CVE-2019-0283
- cpe:2.3:a:sap:netweaver_process_integration:7.11:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.30:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.31:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.40:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.10:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_process_integration:7.50:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-0283
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 21 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-0283
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:N |
8.0
|
4.9
|
NIST | |
|
7.1
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
2.8
|
4.2
|
NIST |
CWE ids for CVE-2019-0283
-
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-0283
-
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114
SAP Security Patch Day – April 2019 - Product Security Response at SAP - SCN WikiVendor Advisory
-
https://launchpad.support.sap.com/#/notes/2747683
SAP ONE Support Launchpad: Log OnPermissions Required;Vendor Advisory
Jump to