Lucene search

SapCVE-2019-0280

HistoryMay 14, 2019 - 9:29 p.m.

CVE-2019-0280

2019-05-1421:29:00

CWE-862

sap

web.nvd.nist.gov

sap

treasury

risk management

ea-finserv 6.0

ea-finserv 6.03

ea-finserv 6.04

ea-finserv 6.05

ea-finserv 6.06

ea-finserv 6.16

ea-finserv 6.17

ea-finserv 6.18

s4core 1.01

s4core 1.02

s4core 1.03

cve-2019-0280

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.

Affected configurations

Nvd

Node

saptreasury_and_risk_managementMatch6.0

saptreasury_and_risk_managementMatch6.03

saptreasury_and_risk_managementMatch6.04

saptreasury_and_risk_managementMatch6.05

saptreasury_and_risk_managementMatch6.06

saptreasury_and_risk_managementMatch6.16

saptreasury_and_risk_managementMatch6.17

saptreasury_and_risk_managementMatch6.18

saptreasury_and_risk_managementMatch8.0

VendorProductVersionCPE
saptreasury_and_risk_management6.0cpe:2.3:a:sap:treasury_and_risk_management:6.0:*:*:*:*:*:*:*
saptreasury_and_risk_management6.03cpe:2.3:a:sap:treasury_and_risk_management:6.03:*:*:*:*:*:*:*
saptreasury_and_risk_management6.04cpe:2.3:a:sap:treasury_and_risk_management:6.04:*:*:*:*:*:*:*
saptreasury_and_risk_management6.05cpe:2.3:a:sap:treasury_and_risk_management:6.05:*:*:*:*:*:*:*
saptreasury_and_risk_management6.06cpe:2.3:a:sap:treasury_and_risk_management:6.06:*:*:*:*:*:*:*
saptreasury_and_risk_management6.16cpe:2.3:a:sap:treasury_and_risk_management:6.16:*:*:*:*:*:*:*
saptreasury_and_risk_management6.17cpe:2.3:a:sap:treasury_and_risk_management:6.17:*:*:*:*:*:*:*
saptreasury_and_risk_management6.18cpe:2.3:a:sap:treasury_and_risk_management:6.18:*:*:*:*:*:*:*
saptreasury_and_risk_management8.0cpe:2.3:a:sap:treasury_and_risk_management:8.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	treasury_and_risk_management	6.0	cpe:2.3:a:sap:treasury_and_risk_management:6.0:::::::*
sap	treasury_and_risk_management	6.03	cpe:2.3:a:sap:treasury_and_risk_management:6.03:::::::*
sap	treasury_and_risk_management	6.04	cpe:2.3:a:sap:treasury_and_risk_management:6.04:::::::*
sap	treasury_and_risk_management	6.05	cpe:2.3:a:sap:treasury_and_risk_management:6.05:::::::*
sap	treasury_and_risk_management	6.06	cpe:2.3:a:sap:treasury_and_risk_management:6.06:::::::*
sap	treasury_and_risk_management	6.16	cpe:2.3:a:sap:treasury_and_risk_management:6.16:::::::*
sap	treasury_and_risk_management	6.17	cpe:2.3:a:sap:treasury_and_risk_management:6.17:::::::*
sap	treasury_and_risk_management	6.18	cpe:2.3:a:sap:treasury_and_risk_management:6.18:::::::*
sap	treasury_and_risk_management	8.0	cpe:2.3:a:sap:treasury_and_risk_management:8.0:::::::*

CNA Affected

[
  {
    "product": "SAP Treasury and Risk Management(EA-FINSERV)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 6.0"
      },
      {
        "status": "affected",
        "version": "< 6.03"
      },
      {
        "status": "affected",
        "version": "< 6.04"
      },
      {
        "status": "affected",
        "version": "< 6.05"
      },
      {
        "status": "affected",
        "version": "< 6.06"
      },
      {
        "status": "affected",
        "version": "< 6.16"
      },
      {
        "status": "affected",
        "version": "< 6.17"
      },
      {
        "status": "affected",
        "version": "< 6.18"
      },
      {
        "status": "affected",
        "version": "< 8.0"
      }
    ]
  },
  {
    "product": "SAP Enterprise Financial Services (S4CORE)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.01"
      },
      {
        "status": "affected",
        "version": "< 1.02"
      },
      {
        "status": "affected",
        "version": "< 1.03"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2744937

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Related for CVE-2019-0280