8.8

CVE-2019-0257

Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Data is provided by the National Vulnerability Database (NVD)
SAP ≫ Netweaver Application Server Abap Version >= 7.0 <= 7.02
SAP ≫ Netweaver Application Server Abap Version >= 7.50 <= 7.53
SAP ≫ Netweaver As Abap Version >= 7.10 <= 7.11
SAP ≫ Netweaver As Abap Version >= 7.74 <= 7.75
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.6% 0.685
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

http://www.securityfocus.com/bid/106999
Third Party Advisory
VDB Entry
https://launchpad.support.sap.com/#/notes/2728839
Vendor Advisory
Permissions Required