{"id":"CVE-2019-0304","aliases":["EUVD-2019-1077","GHSA-cr28-fpxh-wjpp"],"status":"published","title":"FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,...","description":"FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01626,"percentile":0.76322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74","CWE-94"],"published":"2019-06-12T14:21:39Z","modified":"2026-06-17T02:08:09Z","products":[{"vendor":"sap","product":"advanced_business_application_programming_platform_kernel"},{"vendor":"sap","product":"advanced_business_application_programming_platform_krnl32nuc"},{"vendor":"sap","product":"advanced_business_application_programming_platform_krnl32uc"},{"vendor":"sap","product":"advanced_business_application_programming_platform_krnl64nuc"},{"vendor":"sap","product":"advanced_business_application_programming_platform_krnl64uc"},{"vendor":"sap se","product":"sap netweaver as abap platform(kernel)"},{"vendor":"sap se","product":"sap netweaver as abap platform(krnl32nuc)"},{"vendor":"sap se","product":"sap netweaver as abap platform(krnl32uc)"},{"vendor":"sap se","product":"sap netweaver as abap platform(krnl64nuc)"},{"vendor":"sap se","product":"sap netweaver as abap platform(krnl64uc)"}],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2719530","tags":["x_refsource_MISC","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0304"},{"url":"https://github.com/advisories/GHSA-cr28-fpxh-wjpp"}],"sources":{"cve":[{"id":"CVE-2019-0304","description":"FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.","status":"published","published":"2019-06-12T14:21:39Z","modified":"2024-08-04T17:44:16.439Z","updated_at":"2026-11-02T14:32:24.110857Z"}],"euvd":[{"id":"EUVD-2019-1077","description":"FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.","status":"published","published":"2019-06-12T14:21:39Z","modified":"2024-08-04T17:44:16Z","updated_at":"2026-11-03T03:07:02.049822Z"}],"ghsa":[{"id":"GHSA-cr28-fpxh-wjpp","title":"FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,...","description":"FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.","status":"published","published":"2022-05-24T16:47:48Z","modified":"2023-01-28T05:05:23Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:44:20.513282Z"}],"nvd":[{"id":"CVE-2019-0304","description":"FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.","status":"published","published":"2019-06-12T15:29:00.223Z","modified":"2026-06-17T02:08:09.027Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:05:16.285679Z"}]}}