CVE-2019-0257 - Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges

Back Back to CVE browser

HIGH

Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges

Published Feb 15, 2019

8.8

HIGH

CVSS 3.1

EPSS 1.39%

Description

Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Affected products

Vendor SAP SE Product ABAP Platform(SAP Basis) Default
n/a
- Version
  < 7.30
  Status
  affected
  Constraints
  -
- Version
  < 7.31
  Status
  affected
  Constraints
  -
- Version
  < 7.40
  Status
  affected
  Constraints
  -
- Version
  < from 7.0 to 7.02
  Status
  affected
  Constraints
  -
- Version
  < from 7.10 to 7.11
  Status
  affected
  Constraints
  -
- Version
  < from 7.50 to 7.53
  Status
  affected
  Constraints
  -
- Version
  < from 7.74 to 7.75
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

ABAP Platform(SAP Basis)

n/a

Version	Status	Constraints
< 7.30	affected	-
< 7.31	affected	-
< 7.40	affected	-
< from 7.0 to 7.02	affected	-
< from 7.10 to 7.11	affected	-
< from 7.50 to 7.53	affected	-
< from 7.74 to 7.75	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

http://www.securityfocus.com/bid/106999
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1030
Advisory
https://launchpad.support.sap.com/#/notes/2728839
x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
x_refsource_MISCBroken LinkVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/106999		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1030		Advisory
https://launchpad.support.sap.com/#/notes/2728839		x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943		x_refsource_MISCBroken LinkVendor Advisory