CVE-2019-0270 — HIGH (8.8) — White Hats Nepal

Vulnerability Description

ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.

CVSS Score

8.8

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Sap	Advanced Business Application Programming Platform Kernel	7.15
Sap	Advanced Business Application Programming Platform Krnl32Nuc	7.21
Sap	Advanced Business Application Programming Platform Krnl32Uc	7.21
Sap	Advanced Business Application Programming Platform Krnl64Nuc	7.21
Sap	Advanced Business Application Programming Platform Krnl64Uc	7.21

Related Weaknesses (CWE)

CWE-862

References

http://www.securityfocus.com/bid/107377Third Party Advisory
https://launchpad.support.sap.com/#/notes/2727689Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080Vendor Advisory
http://www.securityfocus.com/bid/107377Third Party Advisory
https://launchpad.support.sap.com/#/notes/2727689Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080Vendor Advisory

FAQ

What is CVE-2019-0270?

CVE-2019-0270 is a vulnerability with a CVSS score of 8.8 (HIGH). ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following...

How severe is CVE-2019-0270?

CVE-2019-0270 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-0270?

Check the references section above for vendor advisories and patch information. Affected products include: Sap Advanced Business Application Programming Platform Kernel, Sap Advanced Business Application Programming Platform Krnl32Nuc, Sap Advanced Business Application Programming Platform Krnl32Uc, Sap Advanced Business Application Programming Platform Krnl64Nuc, Sap Advanced Business Application Programming Platform Krnl64Uc.