CVE-2019-0389

8.8HIGH

Key Information:

Vendor
SAP
Status
SAP Netweaver Application Server Java (j2ee-framework)
Vendor
CVE Published:
13 November 2019

Summary

An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for all or some functions in Java Server, and enable users to execute functions, they are not allowed to execute otherwise.

Affected Version(s)

SAP NetWeaver Application Server Java (J2EE-Framework) < 7.1 < 7.1

SAP NetWeaver Application Server Java (J2EE-Framework) < 7.2 < 7.2

SAP NetWeaver Application Server Java (J2EE-Framework) < 7.3 < 7.3

References

https://launchpad.support.sap.com/#/notes/2814357
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.