Read the docs
TI-2019-00216 Aliases CVE-2019-0247GHSA-xvr6-m6gq-m42f

Code injection in SAP Cloud Connector

Priority MEDIUM 45CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Why it matters now

EPSS 0.01272 70th percentileScored 2026-11-07
Fix Fixed SAP Cloud Connector (SAP SE): 2.11.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Cloud Connectorbefore 2.11.32.11.3Patch availableCNA
  • SAP Cloud Connector VendorSAP Affected before 2.11.3 Fixed in 2.11.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:cloud_connector:*:*:*:*:*:*:*:*before 2.11.3VulnerableSAP
  • cpe:2.3:a:sap:cloud_connector:*:*:*:*:*:*:*:* Versions before 2.11.3 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Cloud Connector (SAP SE) Fixed in 2.11.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0247
  2. 2026-10-03 Alias added: GHSA-xvr6-m6gq-m42f

References

Advisory 2

  • TI-2024-16870 Improper Certificate Validation in SAP Cloud Connector CVSS 3.1HIGH 7.4
  • TI-2019-00215 Missing authentication in SAP Cloud Connector CVSS 3.0CRITICAL 9.8
  • TI-2021-13069 Improper certificate validation in SAP Cloud Connector CVSS 3.1CRITICAL 9.1
  • TI-2021-13066 Path traversal in SAP Cloud Connector CVSS 3.1HIGH 7.5
  • TI-2021-13067 Code injection in SAP Cloud Connector CVSS 3.1MEDIUM 6.8
  • TI-2021-13068 Cross-site scripting in SAP Cloud Connector CVSS 3.1MEDIUM 4.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences