CVE-2019-0280 - SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0;

CVE-2019-0280

Summary

SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.

References

Vulnerable Configurations

cpe:2.3:a:sap:treasury_and_risk_management:6.0:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.0:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.03:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.03:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.04:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.05:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.05:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.06:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.06:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.16:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.16:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.17:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.17:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.18:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:6.18:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:8.0:*:*:*:*:*:*:*
cpe:2.3:a:sap:treasury_and_risk_management:8.0:*:*:*:*:*:*:*

CVSS

Base:	6.5 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:

CWE

CWE-862

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	SINGLE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:S/C:P/I:P/A:P

refmap via4

misc

Last major update

24-08-2020 - 17:37

Published

14-05-2019 - 21:29

Last modified

24-08-2020 - 17:37