CVE-2019-0311

MEDIUM

SAP R/3 Enterprise 600-606, 616-617 - Cross-Site Scripting in Automotive Dealer Portal

Title source: llm
STIX 2.1

Description

Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2728153

Scores

CVSS v3 6.1
EPSS 0.0023
EPSS Percentile 45.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (8)
sap/r\/3_enterprise 600
sap/r\/3_enterprise 602
sap/r\/3_enterprise 603
sap/r\/3_enterprise 604
sap/r\/3_enterprise 605
sap/r\/3_enterprise 606
sap/r\/3_enterprise 616
sap/r\/3_enterprise 617
Published Jun 12, 2019
Tracked Since Feb 18, 2026