High severity · published Feb 15, 2019
CVE-2019-0257
Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does…
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
ABAP Platform(SAP Basis) · SAP SE
< from 7.0 to 7.02; < from 7.10 to 7.11; < 7.30; < 7.31; < 7.40; < from 7.50 to 7.53; +1 more · source: vendor
NA
Netweaver AS Abap · Sap
7.10 through 7.11; 7.74 through 7.75 · source: NVD
NA
Netweaver Application Server Abap · Sap
7.0 through 7.02; 7.50 through 7.53; 7.30; 7.31; 7.40 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0257
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0257
Third Party Advisory
http://www.securityfocus.com/bid/106999
Permissions Required
https://launchpad.support.sap.com/#/notes/2728839
Broken Link
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943