CVE-2019-0282

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; can be accessed without user authentication, which might expose internal data like release information, Java package and Java object names which can be misused by the attacker.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver Process Integration (Runtime Workbench)	< from 7.10 to 7.11; < 7.30; < 7.31; < 7.40; < 7.50

References

https://launchpad.support.sap.com/#/notes/2742758Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114Vendor Advisory
https://launchpad.support.sap.com/#/notes/2742758Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114Vendor Advisory

Timeline

Published: Apr 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-02837.1SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signatu CVE-2019-02846.0SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. CVE-2019-02859.8The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information includ CVE-2019-02877.6Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an att CVE-2019-02897.1Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to CVE-2019-02915.5Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.CVE-2019-02936.5Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information CVE-2019-02986.1SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XS CVE-2019-03018.8Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST I CVE-2019-03036.1SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting CVE-2019-03049.8FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRN CVE-2019-03054.3Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40,