CVE-2019-0283

Name: CVE-2019-0283
Creator: NVD / NIST
Published: 2019-04-10T21:29:01.277+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.62%

Last modified Jun 17, 2026

CVE-2019-0283 is a vulnerability of currently unknown severity. SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. EPSS estimates a 0.62% chance of exploitation in the next 30 days.

Description

SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerable to Digital Signature Spoofing. It is possible to spoof XML signatures and send arbitrary requests to the server via PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the xml document.

Metrics

EPSS Probability

0.62%

45.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-290

Affected Software

Vendor	Product	Versions
Sap	Netweaver Process Integration	7.10
Sap	Netweaver Process Integration	7.11
Sap	Netweaver Process Integration	7.30
Sap	Netweaver Process Integration	7.31
Sap	Netweaver Process Integration	7.40
Sap	Netweaver Process Integration	7.50

References

https://launchpad.support.sap.com/#/notes/2747683Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114Vendor Advisory
https://launchpad.support.sap.com/#/notes/2747683Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114Vendor Advisory

Timeline

Published: Apr 10, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-0283?

How severe is CVE-2019-0283?

Severity scoring for CVE-2019-0283 is pending analysis. The EPSS model estimates a 0.62% probability of exploitation in the next 30 days.

How do I fix CVE-2019-0283?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-0283?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST