TI-2019-00300 Aliases CVE-2019-0367 GHSA-fwjq-4h8x-3j22

Missing authorization in SAP NetWeaver Process Integration

LOW 21CWE-862Published 2019-10-08 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.

Why it matters now

EPSS 0.0055 46th percentileScored 2026-11-07

Fix Fixed SAP NetWeaver Process Integration (B2B Toolkit) (SAP SE): 1.0, 2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP NetWeaver Process Integration (B2B Toolkit)	before 1.0; before 2.0	1.0, 2.0	Patch available	CNA

SAP NetWeaver Process Integration (B2B Toolkit) VendorSAP Affected before 1.0; before 2.0 Fixed in 1.0, 2.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_process_integration:1.0:::::::*	1.0	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_process_integration:2.0:::::::*	2.0	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_process_integration:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_process_integration:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·SAP

Remediation

Fix · CNA SAP NetWeaver Process Integration (B2B Toolkit) (SAP SE) Fixed in 1.0, 2.0

Timeline

2026-10-02 Threatist record created from CVE-2019-0367
2026-10-03 Alias added: GHSA-fwjq-4h8x-3j22

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050

Other 1

https://launchpad.support.sap.com/#/notes/2805777

TI-2022-19777 Missing authentication in SAP NetWeaver Process Integration CVSS 3.1CRITICAL 9.9
TI-2022-19776 Missing authentication in SAP NetWeaver Process Integration CVSS 3.1CRITICAL 9.4
TI-2019-00271 OS command injection in SAP NetWeaver Process Integration ABAP tests CVSS 3.0HIGH 7.2
TI-2023-17944 Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench) CVSS 3.1MEDIUM 6.5
TI-2023-17943 Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool) CVSS 3.1MEDIUM 6.5
TI-2019-00262 Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process… CVSS 3.0HIGH 7.5

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences