VULNERABILITY INTELLIGENCE

CVE-2019-0370

CVSS score6.5 MEDIUM
EPSS probability0.72%
CISA KEVNot currently listed
Published2019-10-08
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.

Weakness classification

  • CWE-91: XML Injection (aka Blind XPath Injection)

Primary references