CVE-2019-0365 - SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service

Back Back to CVE browser

HIGH

SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service

Published Sep 10, 2019

7.5

HIGH

CVSS 3.1

EPSS 1.41%

Description

SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

Affected products

Vendor SAP SE Product SAP GUI for Java (BC-FES-JAV) Default
n/a
- Version
  < 7.5
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP GUI for Windows (BC-FES-GUI) Default
n/a
- Version
  < 7.5
  Status
  affected
  Constraints
  -
- Version
  < 7.6
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KERNEL) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.49
  Status
  affected
  Constraints
  -
- Version
  < 7.53
  Status
  affected
  Constraints
  -
- Version
  < 7.73
  Status
  affected
  Constraints
  -
- Version
  < 7.76
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KRNL32NUC) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.21EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.22
  Status
  affected
  Constraints
  -
- Version
  < 7.22EXT
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KRNL32UC) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.21EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.22
  Status
  affected
  Constraints
  -
- Version
  < 7.22EXT
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KRNL64NUC) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.21EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.22
  Status
  affected
  Constraints
  -
- Version
  < 7.22EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.49
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KRNL64UC) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.21EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.22
  Status
  affected
  Constraints
  -
- Version
  < 7.22EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.49
  Status
  affected
  Constraints
  -
- Version
  < 7.73
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP GUI for Java (BC-FES-JAV)

n/a

Version	Status	Constraints
< 7.5	affected	-

SAP SE

SAP GUI for Windows (BC-FES-GUI)

n/a

Version	Status	Constraints
< 7.5	affected	-
< 7.6	affected	-

SAP SE

SAP Kernel (KERNEL)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.49	affected	-
< 7.53	affected	-
< 7.73	affected	-
< 7.76	affected	-

SAP SE

SAP Kernel (KRNL32NUC)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.21EXT	affected	-
< 7.22	affected	-
< 7.22EXT	affected	-

SAP SE

SAP Kernel (KRNL32UC)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.21EXT	affected	-
< 7.22	affected	-
< 7.22EXT	affected	-

SAP SE

SAP Kernel (KRNL64NUC)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.21EXT	affected	-
< 7.22	affected	-
< 7.22EXT	affected	-
< 7.49	affected	-

SAP SE

SAP Kernel (KRNL64UC)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.21EXT	affected	-
< 7.22	affected	-
< 7.22EXT	affected	-
< 7.49	affected	-
< 7.73	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1138
Advisory
https://launchpad.support.sap.com/#/notes/2786151
x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-1138		Advisory
https://launchpad.support.sap.com/#/notes/2786151		x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506		x_refsource_CONFIRMVendor Advisory