CVE-2019-0370

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-91

Affected software

Vendor	Product	Versions
SAP SE	SAP Financial Consolidation	< 10.0; < 10.1

References

https://launchpad.support.sap.com/#/notes/2806403Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050Vendor Advisory
https://launchpad.support.sap.com/#/notes/2806403Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050Vendor Advisory

Timeline

Published: Oct 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-03745.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03755.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03765.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03775.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user CVE-2019-03785.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-CVE-2019-03795.3SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default sec CVE-2019-03804.9Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values t CVE-2019-03815.5A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, CVE-2019-03825.4A Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform (Web Intelligence-Publication related page CVE-2019-03838.8Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0,CVE-2019-03848.8Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0,CVE-2019-03856.5SAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabil