Skip links

CVE-2019-0327 Unrestricted File Upload vulnerability in SAP NetWeaver AS Java (Web Container), SAP security note 2777910

Description

AS Java Web Container allows an attacker to upload files (including script files) without proper file format validation.

Some well-known impacts of Unrestricted File Upload vulnerability are –

  • malicious file insertion or modification
  • make the Web site vulnerable to some other attacks such as XSS

Available fix and Supported packages

  • ENGINEAPI | 7.10 | 7.11
  • ENGINEAPI | 7.20 | 7.20
  • ENGINEAPI | 7.30 | 7.30
  • ENGINEAPI | 7.31 | 7.31
  • ENGINEAPI | 7.40 | 7.40
  • ENGINEAPI | 7.50 | 7.50
  • SERVERCORE | 7.20 | 7.20
  • SERVERCORE | 7.30 | 7.30
  • SERVERCORE | 7.31 | 7.31
  • SERVERCORE | 7.40 | 7.40
  • SERVERCORE | 7.50 | 7.50
  • ENGINEAPI 7.10 | SP024 | 000002
  • ENGINEAPI 7.10 | SP025 | 000000
  • ENGINEAPI 7.11 | SP019 | 000002
  • ENGINEAPI 7.11 | SP020 | 000000
  • ENGINEAPI 7.20 | SP009 | 000053
  • ENGINEAPI 7.30 | SP018 | 000007
  • ENGINEAPI 7.30 | SP019 | 000003
  • ENGINEAPI 7.30 | SP020 | 000000
  • ENGINEAPI 7.31 | SP024 | 000002
  • ENGINEAPI 7.31 | SP025 | 000000
  • ENGINEAPI 7.31 | SP026 | 000000
  • ENGINEAPI 7.40 | SP019 | 000002
  • ENGINEAPI 7.40 | SP020 | 000000
  • ENGINEAPI 7.40 | SP021 | 000000
  • ENGINEAPI 7.50 | SP014 | 000004
  • ENGINEAPI 7.50 | SP015 | 000000
  • ENGINEAPI 7.50 | SP016 | 000000
  • J2EE ENGINE SERVERCORE 7.20 | SP009 | 000137
  • J2EE ENGINE SERVERCORE 7.30 | SP018 | 000029
  • J2EE ENGINE SERVERCORE 7.30 | SP019 | 000009

Affected component

    BC-JAS-WEB
    Web Container, HTTP, JavaMail, Servlets

CVSS

Score: 5.9
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2777910

TAGS

#Upload-of-untrusted-files
#File-upload-vulnerability
#&160-SAP-NetWeaver-AS-Java-(Web-Container)
#&160-CVE-2019-0327