High severity · published Mar 12, 2019
CVE-2019-0270
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
ABAP Platform & Server (KERNEL) · SAP SE
< 7.21; < 7.45; < 7.49; < 7.53; < 7.73; < 7.74; +2 more · source: vendor
AP
ABAP Platform & Server (KRNL32NUC) · SAP SE
< 7.21; < 7.21EXT; < 7.22; < 7.22EXT · source: vendor
AP
ABAP Platform & Server (KRNL32UC) · SAP SE
< 7.21; < 7.21EXT; < 7.22; < 7.22EXT · source: vendor
AP
ABAP Platform & Server (KRNL64NUC) · SAP SE
< 7.21; < 7.21EXT; < 7.22; < 7.22EXT; < 7.49; < 7.74 · source: vendor
AP
ABAP Platform & Server (KRNL64UC) · SAP SE
< 7.21; < 7.21EXT; < 7.22; < 7.22EXT; < 7.49; < 7.73; +2 more · source: vendor
AB
Advanced Business Application Programming Platform Kernel · Sap
7.15; 7.21; 7.22; 7.49; 7.53; 7.73; +3 more · source: NVD
AB
Advanced Business Application Programming Platform Krnl32nuc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
AB
Advanced Business Application Programming Platform Krnl32uc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
AB
Advanced Business Application Programming Platform Krnl64nuc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
AB
Advanced Business Application Programming Platform Krnl64uc · Sap
7.21; 7.21ext; 7.22; 7.22ext; 7.49; 7.73; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0270
Third Party Advisory
http://www.securityfocus.com/bid/107377
Permissions Required
https://launchpad.support.sap.com/#/notes/2727689
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080
