{"id":"CVE-2019-0327","aliases":["EUVD-2019-1100","GHSA-8q67-xv24-8p86"],"status":"published","title":"SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7...","description":"SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.","severity":{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0206,"percentile":0.81462,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2019-07-10T19:09:39Z","modified":"2026-06-17T02:08:10Z","products":[{"vendor":"sap","product":"netweaver_application_server_java"},{"vendor":"sap se","product":"sap netweaver for java application server - web container (engineapi)"},{"vendor":"sap se","product":"sap netweaver for java application server - web container (servercode)"}],"references":[{"url":"http://www.securityfocus.com/bid/109071","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://launchpad.support.sap.com/#/notes/2777910","tags":["x_refsource_MISC","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0327"},{"url":"https://github.com/advisories/GHSA-8q67-xv24-8p86"}],"sources":{"cve":[{"id":"CVE-2019-0327","description":"SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.","status":"published","published":"2019-07-10T19:09:39Z","modified":"2024-08-04T17:44:16.446Z","updated_at":"2026-11-02T14:32:24.110857Z"}],"euvd":[{"id":"EUVD-2019-1100","description":"SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.","status":"published","published":"2019-07-10T19:09:39Z","modified":"2024-08-04T17:44:16Z","updated_at":"2026-11-03T03:07:02.049822Z"}],"ghsa":[{"id":"GHSA-8q67-xv24-8p86","title":"SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7...","description":"SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.","status":"published","published":"2022-05-24T16:49:57Z","modified":"2024-04-04T01:14:30Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:55:56.17809Z"}],"nvd":[{"id":"CVE-2019-0327","description":"SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an attacker to upload files (including script files) without proper file format validation.","status":"published","published":"2019-07-10T20:15:12.06Z","modified":"2026-06-17T02:08:10.887Z","cvss":[{"version":"3.0","score":7.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:05:19.195714Z"}]}}