High severity · published Sep 10, 2019
CVE-2019-0365
SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL…
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SK
Sap Kernel · Sap
7.21; 7.49; 7.53; 7.73; 7.76 · source: NVD
SK
Sap Kernel Krnl32nuc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
SK
Sap Kernel Krnl32uc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
SK
Sap Kernel Krnl64nuc · Sap
7.21; 7.21ext; 7.22; 7.22ext · source: NVD
SK
Sap Kernel Krnl64uc · Sap
7.21; 7.21ext; 7.22; 7.22ext; 7.49; 7.73 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0365
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0365
Permissions Required
https://launchpad.support.sap.com/#/notes/2786151
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506
More from Sap Kernel
8.8
CVE-2017-16689
A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 to 7.22, 7.45, 7.49,…
7.5
CVE-2018-2433
SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.53) allows…
7.5
CVE-2018-2360
SAP Startup Service, SAP KERNEL 7.45, 7.49, and 7.52, is missing an authentication check for functionalities that require user identity and cause consumption of file system…
7.5
CVE-2017-5997
The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service (memory consumption and process crash) via multiple…
6.5
CVE-2019-0271
ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an XML External Entity…