Read the docs
TI-2019-00259 Aliases CVE-2019-0311GHSA-x73m-hvq6-32m3

Cross-site scripting in SAP R/3 Enterprise Application

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inputs, this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there, resulting in Cross-Site Scripting (XSS) vulnerability.

Why it matters now

EPSS 0.008 56th percentileScored 2026-11-07
Fix Fixed SAP R/3 Enterprise Application (SAP SE): 6.0, 6.02, 6.03 +5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP R/3 Enterprise Applicationbefore 6.0; before 6.02; before 6.03; before 6.04; before 6.05; before 6.06; before 6.16; before 6.176.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17Patch availableCNA
  • SAP R/3 Enterprise Application VendorSAP Affected before 6.0; before 6.02; before 6.03; before 6.04; before 6.05; before 6.06; before 6.16; before 6.17 Fixed in 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:sap:r\/3_enterprise:600:*:*:*:*:*:*:*600VulnerableSAP
cpe:2.3:a:sap:r\/3_enterprise:602:*:*:*:*:*:*:*602VulnerableSAP
cpe:2.3:a:sap:r\/3_enterprise:603:*:*:*:*:*:*:*603VulnerableSAP
cpe:2.3:a:sap:r\/3_enterprise:604:*:*:*:*:*:*:*604VulnerableSAP
cpe:2.3:a:sap:r\/3_enterprise:605:*:*:*:*:*:*:*605VulnerableSAP
cpe:2.3:a:sap:r\/3_enterprise:606:*:*:*:*:*:*:*606VulnerableSAP
cpe:2.3:a:sap:r\/3_enterprise:616:*:*:*:*:*:*:*616VulnerableSAP
cpe:2.3:a:sap:r\/3_enterprise:617:*:*:*:*:*:*:*617VulnerableSAP
  • cpe:2.3:a:sap:r\/3_enterprise:600:*:*:*:*:*:*:* Versions 600 Vulnerable ·SAP
  • cpe:2.3:a:sap:r\/3_enterprise:602:*:*:*:*:*:*:* Versions 602 Vulnerable ·SAP
  • cpe:2.3:a:sap:r\/3_enterprise:603:*:*:*:*:*:*:* Versions 603 Vulnerable ·SAP
  • cpe:2.3:a:sap:r\/3_enterprise:604:*:*:*:*:*:*:* Versions 604 Vulnerable ·SAP
  • cpe:2.3:a:sap:r\/3_enterprise:605:*:*:*:*:*:*:* Versions 605 Vulnerable ·SAP
  • cpe:2.3:a:sap:r\/3_enterprise:606:*:*:*:*:*:*:* Versions 606 Vulnerable ·SAP
  • cpe:2.3:a:sap:r\/3_enterprise:616:*:*:*:*:*:*:* Versions 616 Vulnerable ·SAP
  • cpe:2.3:a:sap:r\/3_enterprise:617:*:*:*:*:*:*:* Versions 617 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP R/3 Enterprise Application (SAP SE) Fixed in 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0311
  2. 2026-10-03 Alias added: GHSA-x73m-hvq6-32m3

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences