Read the docs
TI-2019-00311 Aliases CVE-2019-0381GHSA-g6vv-79qp-w952

A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1…

Priority LOW 25CWE-552Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-552.

Summary

A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified by the user.

Why it matters now

EPSS 0.00309 23rd percentileScored 2026-11-07
Fix Fixed SAP IQ (SAP SE): 16.1SAP SQL Anywhere (SAP SE): 17.0+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP IQbefore 16.116.1Patch availableCNA
SAPSAP SQL Anywherebefore 17.017.0Patch availableCNA
SAPSAP Dynamic Tieringbefore 1.0; before 2.01.0, 2.0Patch availableCNA
  • SAP IQ VendorSAP Affected before 16.1 Fixed in 16.1 Patch available CNA
  • SAP SQL Anywhere VendorSAP Affected before 17.0 Fixed in 17.0 Patch available CNA
  • SAP Dynamic Tiering VendorSAP Affected before 1.0; before 2.0 Fixed in 1.0, 2.0 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:sap:dynamic_tier:1.0:*:*:*:*:*:*:*1.0VulnerableSAP
cpe:2.3:a:sap:dynamic_tier:2.0:*:*:*:*:*:*:*2.0VulnerableSAP
cpe:2.3:a:sap:sap_iq:16.1:*:*:*:*:*:*:*16.1VulnerableSAP
cpe:2.3:a:sap:sql_anywhere:17.0:*:*:*:*:*:*:*17.0VulnerableSAP
  • cpe:2.3:a:sap:dynamic_tier:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:dynamic_tier:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:sap_iq:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·SAP
  • cpe:2.3:a:sap:sql_anywhere:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP IQ (SAP SE) Fixed in 16.1
  • Fix · CNA SAP SQL Anywhere (SAP SE) Fixed in 17.0
  • Fix · CNA SAP Dynamic Tiering (SAP SE) Fixed in 1.0, 2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0381
  2. 2026-10-03 Alias added: GHSA-g6vv-79qp-w952

References

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences