CVE-2019-0279

EUVD-2019-1052
ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
sapbusiness_application_software_integrated_solution
7.00 ≤
𝑥
≤ 7.02
sapbusiness_application_software_integrated_solution
7.10 ≤
𝑥
≤ 7.30
sapbusiness_application_software_integrated_solution
7.50 ≤
𝑥
≤ 7.53
sapbusiness_application_software_integrated_solution
7.31
sapbusiness_application_software_integrated_solution
7.40
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://launchpad.support.sap.com/#/notes/2753629
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114
https://launchpad.support.sap.com/#/notes/2753629
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114