CVE-2019-0280 - SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges

Back Back to CVE browser

HIGH

SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges

Published May 14, 2019

8.8

HIGH

CVSS 3.0

EPSS 1.12%

Description

SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.

Affected products

Vendor SAP SE Product SAP Enterprise Financial Services (S4CORE) Default
n/a
- Version
  < 1.01
  Status
  affected
  Constraints
  -
- Version
  < 1.02
  Status
  affected
  Constraints
  -
- Version
  < 1.03
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Treasury and Risk Management(EA-FINSERV) Default
n/a
- Version
  < 6.0
  Status
  affected
  Constraints
  -
- Version
  < 6.03
  Status
  affected
  Constraints
  -
- Version
  < 6.04
  Status
  affected
  Constraints
  -
- Version
  < 6.05
  Status
  affected
  Constraints
  -
- Version
  < 6.06
  Status
  affected
  Constraints
  -
- Version
  < 6.16
  Status
  affected
  Constraints
  -
- Version
  < 6.17
  Status
  affected
  Constraints
  -
- Version
  < 6.18
  Status
  affected
  Constraints
  -
- Version
  < 8.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Enterprise Financial Services (S4CORE)

n/a

Version	Status	Constraints
< 1.01	affected	-
< 1.02	affected	-
< 1.03	affected	-

SAP SE

SAP Treasury and Risk Management(EA-FINSERV)

n/a

Version	Status	Constraints
< 6.0	affected	-
< 6.03	affected	-
< 6.04	affected	-
< 6.05	affected	-
< 6.06	affected	-
< 6.16	affected	-
< 6.17	affected	-
< 6.18	affected	-
< 8.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1053
Advisory
https://launchpad.support.sap.com/#/notes/2744937
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1053		Advisory
https://launchpad.support.sap.com/#/notes/2744937		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032		x_refsource_MISCVendor Advisory