SB2019121214 - Multiple vulerabilities in SAP Enable Now
Published: December 12, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Command Injection (CVE-ID: CVE-2019-0403)
The vulnerability allows a remote attacker to execute arbitrary commands into CSV files.
The vulnerability exists due to insufficient sanitization of user-supplied data when constructing CSV files. A remote unauthenticated attacker can input commands into the CSV files, trick a victim into opening it and execute arbitrary commands on the target system.
2) Information disclosure (CVE-ID: CVE-2019-0405)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected software leaks information about the existence of a particular user. A remote attacker can gain unauthorized access to sensitive information on the system, such as a user enumeration.
3) Information disclosure (CVE-ID: CVE-2019-0404)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected software leaks information about network configuration in the server error messages. A remote attacker can gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.