VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jun 12, 2019· Updated Jun 17, 2026

CVE-2019-0311

CVE-2019-0311

Description

Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected products

10
  • SAP/R\/3 Enterprise8 versions
    cpe:2.3:a:sap:r\/3_enterprise:600:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:sap:r\/3_enterprise:600:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:r\/3_enterprise:602:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:r\/3_enterprise:603:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:r\/3_enterprise:604:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:r\/3_enterprise:605:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:r\/3_enterprise:606:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:r\/3_enterprise:616:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:r\/3_enterprise:617:*:*:*:*:*:*:*
  • SAP/R/3 Enterprise Applicationllm-create
    Range: 600, 602, 603, 604, 605, 606, 616, 617
  • SAP SE/SAP R/3 Enterprise Applicationv5
    Range: < 6.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.