Missing Authorization Check in SAP Kernel's ABAP Debugger
CVE-2019-0349

7.2HIGH

Key Information:

Vendor
SAP
Status
SAP Kernel (krnl32nuc)
SAP Kernel (krnl32uc)
SAP Kernel (krnl64nuc)
SAP Kernel (krnl64uc)
Vendor
CVE Published:
14 August 2019

Summary

A vulnerability exists in the SAP Kernel (ABAP Debugger) that allows users to execute 'Go to statement' commands without the required authorization S_DEVELOP DEBUG 02. This oversight in authorization checks can lead to unauthorized access to sensitive debugging features, potentially facilitating further exploitation within the system.

Affected Version(s)

SAP Kernel (KERNEL) < 7.21 < 7.21

SAP Kernel (KERNEL) < 7.49 < 7.49

SAP Kernel (KERNEL) < 7.53 < 7.53

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2798743
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.