CVE-2019-0280
SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not pe
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.0, 6.03, 6.04, 6.05, 6.06, and 7 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.
Timeline
- CVE published
- Record last updated
Affected versions
- SAP SE SAP Treasury and Risk Management(EA-FINSERV)
fixed in 6.0; fixed in 6.03; fixed in 6.04; fixed in 6.05; fixed in 6.06; fixed in 6.16; fixed in 6.17; fixed in 6.18; fixed in 8.0
- SAP SE SAP Enterprise Financial Services (S4CORE)
fixed in 1.01; fixed in 1.02; fixed in 1.03