The SAP security note addresses several vulnerabilities identified in SAP Financial Consolidation. The vulnerability details along with their CVE relevant information can be found below.

1. XPath Injection

The SAP Financial Consolidation legacy web enables malicious users to use crafted input to break out of the data context in which their input appears and to interfere with the structure of the surrounding query.

• CVE-2019-0370
• CVSS Score: 5.4; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Some well Known impact of Xpath injection vulnerability include

• exploitation of an XPath injection flaw in order to read sensitive application data or to interfere with application logic.

2. Cross Site Scripting

The SAP Financial Consolidation legacy web client does not sufficiently encode user controlled inputs, resulting in a reflected cross-site scripting (XSS) vulnerability.

• CVE-2019-0369
• CVSS Score: 5.4; CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Some well-known impacts of XSS vulnerability include

• non-permanently deface or modify displayed content from a web site
• steal authentication information of the user, such as data relating to their current session
• impersonate the user and access all information with the same rights as the target user