CVE-2019-0391

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS Java	< 7.10; < 7.20; < 7.30; < 7.31; < 7.40; < 7.50

References

https://launchpad.support.sap.com/#/notes/2835226Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390Vendor Advisory
https://launchpad.support.sap.com/#/notes/2835226Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390Vendor Advisory

Timeline

Published: Nov 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-03934.3An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry ou CVE-2019-03955.4SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module CVE-2019-03967.1SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected in versions 4.1 and 4.2, does not sufficient CVE-2019-03988.8Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 a CVE-2019-03996.5SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allow CVE-2019-04024.4SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, lea CVE-2019-04039.8SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CVE-2019-04047.5SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disc CVE-2019-04057.5SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of use CVE-2019-05365.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information CVE-2019-05375.5An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicio CVE-2019-05387.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database En