Vulnerability CVE-2019-0384


Published: 2019-12-17

Description:
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.

Type:

CWE-863

(Incorrect Authorization)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.5/10
6.4/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
SAP -> Enterprise extension financial services 
SAP -> Treasury and risk management \(s4core\) 

 References:
https://launchpad.support.sap.com/#/notes/2828981
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390

Copyright 2024, cxsecurity.com

 

Back to Top