CVE-2019-0280

SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
sapCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
VendorProductVersion
saptreasury_and_risk_management
6.0
saptreasury_and_risk_management
6.03
saptreasury_and_risk_management
6.04
saptreasury_and_risk_management
6.05
saptreasury_and_risk_management
6.06
saptreasury_and_risk_management
6.16
saptreasury_and_risk_management
6.17
saptreasury_and_risk_management
6.18
saptreasury_and_risk_management
8.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://launchpad.support.sap.com/#/notes/2744937
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032
https://launchpad.support.sap.com/#/notes/2744937
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032