CVE-2019-0319

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-07-10 · updated 2026-06-17
Weakness: CWE-74

Description

The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not.

Affected products

SAP SE SAP Gateway: 7.5, 7.51, 7.52, 7.53
SAP SE SAP UI5: 1.0.0

References

http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html
http://www.securityfocus.com/bid/109074
https://cxsecurity.com/ascii/WLB-2019050283
https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f
https://launchpad.support.sap.com/#/notes/2752614
https://launchpad.support.sap.com/#/notes/2911267
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575
http://packetstormsecurity.com/files/153661/SAPUI5-1.0.0-SAP-Gateway-7.5-7.51-7.52-7.53-Content-Spoofing.html
http://www.securityfocus.com/bid/109074
https://cxsecurity.com/ascii/WLB-2019050283
https://drive.google.com/open?id=1aGFqggvydehSK7MFIsfKW7tO60yiF55f
https://launchpad.support.sap.com/#/notes/2752614

Get alerted when CVE-2019-0319 or the next vulnerability affects your stack