CVE-2019-0384
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0,
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.01, 1.02, 1.03, 1.04, 6.0, and 8 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.
Timeline
- CVE published
- Record last updated
Affected versions
- SAP SE SAP Treasury and Risk Management (S4CORE)
fixed in 1.01; fixed in 1.02; fixed in 1.03; fixed in 1.04
- SAP SE SAP Treasury and Risk Management (EA-FINSERV)
fixed in 6.0; fixed in 6.03; fixed in 6.04; fixed in 6.05; fixed in 6.06; fixed in 6.16; fixed in 6.17; fixed in 6.18; fixed in 8.0