TI-2019-00302 Aliases CVE-2019-0369 GHSA-82mv-hh8r-x8q6

Cross-site scripting in SAP Financial Consolidation

LOW 25CWE-79Published 2019-10-08 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to execute scripts by uploading files containing malicious scripts, leading to reflected cross site scripting vulnerability.

Why it matters now

EPSS 0.00526 44th percentileScored 2026-11-07

Fix Fixed SAP Financial Consolidation (SAP SE): 10.0, 10.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Financial Consolidation	before 10.0; before 10.1	10.0, 10.1	Patch available	CNA

SAP Financial Consolidation VendorSAP Affected before 10.0; before 10.1 Fixed in 10.0, 10.1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:financial_consolidation:10.0:::::::*	10.0	Vulnerable	SAP
cpe:2.3:a:sap:financial_consolidation:10.1:::::::*	10.1	Vulnerable	SAP

cpe:2.3:a:sap:financial_consolidation:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·SAP
cpe:2.3:a:sap:financial_consolidation:10.1:*:*:*:*:*:*:* Versions 10.1 Vulnerable ·SAP

Remediation

Fix · CNA SAP Financial Consolidation (SAP SE) Fixed in 10.0, 10.1

Timeline

2026-10-02 Threatist record created from CVE-2019-0369
2026-10-03 Alias added: GHSA-82mv-hh8r-x8q6

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050

Other 1

https://launchpad.support.sap.com/#/notes/2806403

TI-2019-00303 XML injection in SAP Financial Consolidation CVSS 3.1MEDIUM 6.5
TI-2022-19766 Cross-site scripting in SAP Financial Consolidation CVSS 3.1MEDIUM 6.5
TI-2022-19768 Cross-site scripting in SAP Financial Consolidation CVSS 3.1MEDIUM 6.1
TI-2022-19720 Cross-site scripting in SAP Financial Consolidation CVSS 3.1MEDIUM 5.4
TI-2022-09568 Missing authorization in SAP Financial Consolidation CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences