Critical severity · published Jun 12, 2019
CVE-2019-0304
FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT,…
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Advanced Business Application Programming Platform Kernel · Sap
7.21; 7.45; 7.49; 7.53; 7.73 · source: NVD
AB
Advanced Business Application Programming Platform Krnl32nuc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
AB
Advanced Business Application Programming Platform Krnl32uc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
AB
Advanced Business Application Programming Platform Krnl64nuc · Sap
7.21; 7.21ext; 7.22; 7.22ext; 7.49 · source: NVD
AB
Advanced Business Application Programming Platform Krnl64uc · Sap
7.21; 7.21ext; 7.22; 7.22ext; 7.49; 7.73 · source: NVD
Affected product
AB
Advanced Business Application Programming Platform Kernel
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0304
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0304
Permissions Required
https://launchpad.support.sap.com/#/notes/2719530
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
More from Advanced Business Application Programming Platform Kernel
8.8
CVE-2019-0270
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges
8.1
CVE-2019-0255
SAP NetWeaver AS ABAP Platform, Krnl64nuc 7.74, krnl64UC 7.73, 7.74, Kernel 7.73, 7.74, 7.75, fails to validate type of installation for an ABAP Server system correctly
7.2
CVE-2019-0349
SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21,…
4.9
CVE-2019-0265
SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service