CVE-2019-0304

high-risk
Published 2019-06-12

FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.

Do I need to act?

-
0.50% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

Advanced Business Application Programming Platform Kernel
Advanced Business Application Programming Platform Kernel
Advanced Business Application Programming Platform Kernel
Advanced Business Application Programming Platform Kernel
Advanced Business Application Programming Platform Kernel
Advanced Business Application Programming Platform Krnl32Nuc
Advanced Business Application Programming Platform Krnl32Nuc
Advanced Business Application Programming Platform Krnl32Nuc
Advanced Business Application Programming Platform Krnl32Nuc
Advanced Business Application Programming Platform Krnl32Uc
Advanced Business Application Programming Platform Krnl32Uc
Advanced Business Application Programming Platform Krnl32Uc
Advanced Business Application Programming Platform Krnl32Uc
Advanced Business Application Programming Platform Krnl64Nuc
Advanced Business Application Programming Platform Krnl64Nuc
Advanced Business Application Programming Platform Krnl64Nuc
Advanced Business Application Programming Platform Krnl64Nuc
Advanced Business Application Programming Platform Krnl64Nuc
Advanced Business Application Programming Platform Krnl64Uc
Advanced Business Application Programming Platform Krnl64Uc

Affected Vendors

Sap

References (4)

Permissions Required https://launchpad.support.sap.com/#/notes/2719530
Vendor Advisory https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
Permissions Required https://launchpad.support.sap.com/#/notes/2719530
Vendor Advisory https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
55
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 2/34 · Minimal
Exposure 21/34 · High