Medium severity · published Feb 15, 2019
CVE-2019-0265
SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service
4.9
CVSS
2.1%
EPSS
No
On KEV
Description
SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49. 7.73 KERNEL from 7.21 to 7.22, 7.45, 7.49, 7.53, 7.73, 7.75.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
ABAP Platform (KERNEL) · SAP SE
< from 7.21 to 7.22; < 7.45; < 7.49; < 7.53; < 7.73; < 7.75 · source: vendor
AP
ABAP Platform (KRNL32NUC) · SAP SE
< 7.21; < 7.21EXT; < 7.22; < 7.22EXT · source: vendor
AP
ABAP Platform (KRNL32UC) · SAP SE
< 7.21; < 7.21EXT; < 7.22; < 7.22EXT · source: vendor
AP
ABAP Platform (KRNL64NUC) · SAP SE
< 7.21; < 7.21EXT; < 7.22; < 7.22EXT; < 7.49 · source: vendor
AP
ABAP Platform (KRNL64UC) · SAP SE
< 7.21; < 7.21EXT; < 7.22; < 7.22EXT; < 7.49; < 7.73 · source: vendor
AB
Advanced Business Application Programming Platform Kernel · Sap
7.21 through 7.22; 7.45; 7.49; 7.53; 7.73; 7.75. · source: NVD
AB
Advanced Business Application Programming Platform Krnl32nuc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
AB
Advanced Business Application Programming Platform Krnl32uc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
AB
Advanced Business Application Programming Platform Krnl64nuc · Sap
7.21; 7.21ext; 7.22; 7.22ext; 7.49 · source: NVD
AB
Advanced Business Application Programming Platform Krnl64uc · Sap
7.21; 7.21ext; 7.22; 7.22ext; 7.49; 7.73 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0265
Third Party Advisory
http://www.securityfocus.com/bid/106972
Third Party Advisory
http://www.securityfocus.com/bid/107364
Permissions Required
https://launchpad.support.sap.com/#/notes/2729710
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943