CVE-2019-0370

Description

Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.285

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2019-0369,CVE-2019-0370 are affected in SAP Financial Consolidation 10.0	Windows
Vulnerabilities CVE-2019-0369,CVE-2019-0370,CVE-2022-26104 are affected in SAP Financial Consolidation 10.1	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234