CVE-2019-0367

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver Process Integration (B2B Toolkit)	< 1.0; < 2.0

References

https://launchpad.support.sap.com/#/notes/2805777Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050Vendor Advisory
https://launchpad.support.sap.com/#/notes/2805777Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050Vendor Advisory

Timeline

Published: Oct 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-03685.4SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7 CVE-2019-03695.4SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to CVE-2019-03706.5Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to int CVE-2019-03745.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03755.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03765.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03775.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user CVE-2019-03785.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-CVE-2019-03795.3SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default sec CVE-2019-03804.9Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values t CVE-2019-03815.5A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, CVE-2019-03825.4A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related page