Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-0254: SAP Disclosure Management allows malicious script injection

CVE-2019-0254 · published 7 years ago

Summary

The SAP Disclosure Management tool does not properly clean data that users can enter, so an attacker could insert harmful code that runs in another user's web browser. This could let the attacker view or steal information or take actions on behalf of the user. Upgrade to the latest version or apply the vendor's recommended patch to fix the issue.

What to do

Update sap disclosure_management to version 10.1 or later.

Affected software

Vendor	Product	Affected versions
sap	disclosure_management	< 10.1 `cpe:2.3:a:sap:disclosure_management::::::::`

Original advisory text

SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

References

http://www.securityfocus.com/bid/107004 Third Party Advisory
https://launchpad.support.sap.com/#/notes/2706798 Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published15 Feb 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-0254 · NVD

Track software like this

Free during beta