CVE-2019-0386

6.3MEDIUM

Key Information:

Vendor
SAP
Status
SAP Erp Sales (SAP Appl)
S4hana Sales (s4core)
Vendor
CVE Published:
13 November 2019

Summary

Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges.

Affected Version(s)

S4HANA Sales (S4CORE) < 1.0 < 1.0

S4HANA Sales (S4CORE) < 1.01 < 1.01

S4HANA Sales (S4CORE) < 1.02 < 1.02

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2840520
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.