Vulnerability in SAP Dynamic Tier
CVE-2019-0381
A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified by the user.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (21.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 21.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- SAP Dynamic Tier — versions 1.0, 2.0
- SAP Iq — versions 16.1
- SAP SQL Anywhere — versions 17.0
- SAP Se Dynamic Tiering — versions < 1.0, < 2.0
- SAP Se Iq — versions < 16.1
- SAP Se SQL Anywhere — versions < 17.0
Weakness classification (CWE)
References
- wiki.scn.sap.com/wiki/pages/viewpage.action (Vendor Advisory)
- launchpad.support.sap.com/ (Permissions Required)
Frequently asked questions
- What is CVE-2019-0381?
- CVE-2019-0381 is a medium-severity vulnerability in SAP Dynamic Tier, classified under Files or Directories Accessible to External Parties. CVSS score: 5.5/10. Published 2019-10-08.
- How severe is CVE-2019-0381?
- Medium severity. CVSS v3 base score is 5.5 out of 10.