Lucene search

SapCVE-2019-0270

HistoryMar 12, 2019 - 10:29 p.m.

CVE-2019-0270

2019-03-1222:29:00

CWE-862

sap

web.nvd.nist.gov

cve-2019-0270

abap server

sap netweaver

abap platform

authorization checks

privilege escalation

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.003

Percentile

68.4%

JSON

ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.

Affected configurations

Nvd

Node

sapadvanced_business_application_programming_platform_kernelMatch7.15

sapadvanced_business_application_programming_platform_kernelMatch7.21

sapadvanced_business_application_programming_platform_kernelMatch7.22

sapadvanced_business_application_programming_platform_kernelMatch7.49

sapadvanced_business_application_programming_platform_kernelMatch7.53

sapadvanced_business_application_programming_platform_kernelMatch7.73

sapadvanced_business_application_programming_platform_kernelMatch7.74

sapadvanced_business_application_programming_platform_kernelMatch7.75

sapadvanced_business_application_programming_platform_kernelMatch8.04

sapadvanced_business_application_programming_platform_krnl32nucMatch7.21

sapadvanced_business_application_programming_platform_krnl32nucMatch7.21ext

sapadvanced_business_application_programming_platform_krnl32nucMatch7.22

sapadvanced_business_application_programming_platform_krnl32nucMatch7.22ext

sapadvanced_business_application_programming_platform_krnl32ucMatch7.21

sapadvanced_business_application_programming_platform_krnl32ucMatch7.21ext

sapadvanced_business_application_programming_platform_krnl32ucMatch7.22

sapadvanced_business_application_programming_platform_krnl32ucMatch7.22ext

sapadvanced_business_application_programming_platform_krnl64nucMatch7.21

sapadvanced_business_application_programming_platform_krnl64nucMatch7.21ext

sapadvanced_business_application_programming_platform_krnl64nucMatch7.22

sapadvanced_business_application_programming_platform_krnl64nucMatch7.22ext

sapadvanced_business_application_programming_platform_krnl64ucMatch7.21

sapadvanced_business_application_programming_platform_krnl64ucMatch7.21ext

sapadvanced_business_application_programming_platform_krnl64ucMatch7.22

sapadvanced_business_application_programming_platform_krnl64ucMatch7.22ext

sapadvanced_business_application_programming_platform_krnl64ucMatch7.49

sapadvanced_business_application_programming_platform_krnl64ucMatch7.73

sapadvanced_business_application_programming_platform_krnl64ucMatch7.74

sapadvanced_business_application_programming_platform_krnl64ucMatch8.04

VendorProductVersionCPE
sapadvanced_business_application_programming_platform_kernel7.15cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.15:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_kernel7.21cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.21:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_kernel7.22cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.22:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_kernel7.49cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.49:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_kernel7.53cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.53:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_kernel7.73cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.73:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_kernel7.74cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.74:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_kernel7.75cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.75:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_kernel8.04cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:8.04:*:*:*:*:*:*:*
sapadvanced_business_application_programming_platform_krnl32nuc7.21cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	advanced_business_application_programming_platform_kernel	7.15	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.15:::::::*
sap	advanced_business_application_programming_platform_kernel	7.21	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.21:::::::*
sap	advanced_business_application_programming_platform_kernel	7.22	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.22:::::::*
sap	advanced_business_application_programming_platform_kernel	7.49	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.49:::::::*
sap	advanced_business_application_programming_platform_kernel	7.53	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.53:::::::*
sap	advanced_business_application_programming_platform_kernel	7.73	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.73:::::::*
sap	advanced_business_application_programming_platform_kernel	7.74	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.74:::::::*
sap	advanced_business_application_programming_platform_kernel	7.75	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.75:::::::*
sap	advanced_business_application_programming_platform_kernel	8.04	cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:8.04:::::::*
sap	advanced_business_application_programming_platform_krnl32nuc	7.21	cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21:::::::*

Rows per page:

1-10 of 291

CNA Affected

[
  {
    "product": "ABAP Platform & Server (KRNL32NUC)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.21EXT"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      }
    ]
  },
  {
    "product": "ABAP Platform & Server (KRNL32UC)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.21EXT"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      }
    ]
  },
  {
    "product": "ABAP Platform & Server (KRNL64NUC)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.21EXT"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      },
      {
        "status": "affected",
        "version": "< 7.49"
      },
      {
        "status": "affected",
        "version": "< 7.74"
      }
    ]
  },
  {
    "product": "ABAP Platform & Server (KRNL64UC)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.21EXT"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      },
      {
        "status": "affected",
        "version": "< 7.49"
      },
      {
        "status": "affected",
        "version": "< 7.73"
      },
      {
        "status": "affected",
        "version": "< 7.74"
      },
      {
        "status": "affected",
        "version": "< 8.04"
      }
    ]
  },
  {
    "product": "ABAP Platform & Server (KERNEL)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.45"
      },
      {
        "status": "affected",
        "version": "< 7.49"
      },
      {
        "status": "affected",
        "version": "< 7.53"
      },
      {
        "status": "affected",
        "version": "< 7.73"
      },
      {
        "status": "affected",
        "version": "< 7.74"
      },
      {
        "status": "affected",
        "version": "< 7.75"
      },
      {
        "status": "affected",
        "version": "< 8.04"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107377

launchpad.support.sap.com/#/notes/2727689

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.003

Percentile

68.4%

JSON

Related for CVE-2019-0270