1. CVE-Search
  2. CVE-2019-0257
ID CVE-2019-0257
Summary Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
References
Vulnerable Configurations
  • cpe:2.3:a:sap:netweaver_as_abap:*:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_as_abap:*:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.31:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.31:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.0:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.02:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.02:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.02:sp6:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.02:sp6:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.30:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.30:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.40:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.40:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.50:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.50:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.50:*:*:*:developer:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.50:*:*:*:developer:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.50:sp02:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.50:sp02:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.50:sp02:*:*:developer:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.50:sp02:*:*:developer:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.51:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.51:*:*:*:*:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.51:sp02:*:*:developer:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.51:sp02:*:*:developer:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.52:sp01:*:*:developer:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.52:sp01:*:*:developer:*:*:*
  • cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*
    cpe:2.3:a:sap:netweaver_application_server_abap:7.53:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 05-10-2022 - 14:17)
Impact:
Exploitability:
CWE CWE-862
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
refmap via4
bid 106999
misc
Last major update 05-10-2022 - 14:17
Published 15-02-2019 - 18:29
Last modified 05-10-2022 - 14:17
Back to Top