High severity · published Feb 15, 2019
CVE-2019-0255
SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly
8.1
CVSS
1.7%
EPSS
No
On KEV
Description
SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly. That behavior may lead to situation, where business user achieves access to the full SAP Menu, that is 'Easy Access Menu'. The situation can be misused by any user to leverage privileges to business functionality.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Advanced Business Application Programming Platform Kernel · Sap
7.73; 7.74; 7.75. · source: NVD
AB
Advanced Business Application Programming Platform Krnl64nuc · Sap
7.74 · source: NVD
AB
Advanced Business Application Programming Platform Krnl64uc · Sap
7.73; 7.74 · source: NVD
Affected product
AB
Advanced Business Application Programming Platform Kernel
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0255
Third Party Advisory
http://www.securityfocus.com/bid/106987
Permissions Required
https://launchpad.support.sap.com/#/notes/2723570
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
More from Advanced Business Application Programming Platform Kernel
9.8
CVE-2019-0304
FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT,…
8.8
CVE-2019-0270
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges
7.2
CVE-2019-0349
SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21,…
4.9
CVE-2019-0265
SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service