CVE-2019-0244

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP SE	SAP CRM WebClient UI (SAPSCORE)	< 1.12
SAP SE	SAP CRM WebClient UI (S4FND)	< 1.02
SAP SE	SAP CRM WebClient UI (WEBCUIF)	< 7.31; < 7.46; < 7.47; < 7.48; < 8.0; < 8.01

References

http://www.securityfocus.com/bid/106473Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2588763Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985Vendor Advisory
http://www.securityfocus.com/bid/106473Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2588763Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=509151985Vendor Advisory

Timeline

Published: Jan 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-02455.4SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-contr CVE-2019-02469.8SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.CVE-2019-02479.8SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could the CVE-2019-02485.9Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker CVE-2019-02497.5Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.CVE-2019-02516.1The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in C CVE-2019-02545.4SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scri CVE-2019-02558.1SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an CVE-2019-02565.5Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise CVE-2019-02578.8Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7 CVE-2019-02588.8SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation CVE-2019-02599.8SAP BusinessObjects, versions 4.2 and 4.3, (Visual Difference) allows an attacker to upload any file (including script files) without proper