PT-2019-11222 · Sap · Sap Solution Manager

Publicado 2019-05-14 · Atualizado 2020-08-24 · CVE-2019-0293

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP Solution Manager system (ST-PI) versions prior to 2008 1 700 SAP Solution Manager system (ST-PI) versions prior to 2008 1 710 SAP Solution Manager system (ST-PI) version prior to 740

Description: The issue is related to the read of RFC destination, which does not always perform necessary authorization checks. This results in escalation of privileges to access information on RFC destinations on managed systems and the SAP Solution Manager system.

Recommendations: For SAP Solution Manager system (ST-PI) versions prior to 2008 1 700, update to version 2008 1 700 or later. For SAP Solution Manager system (ST-PI) versions prior to 2008 1 710, update to version 2008 1 710 or later. For SAP Solution Manager system (ST-PI) version prior to 740, update to version 740 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2019-0293

Produtos afetados

Sap Solution Manager

Referências · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 · Aviso do Fabricante
• http://securityfocus.com/bid/108324 · Nota
• https://osv.dev/vulnerability/CVE-2019-0293 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0293 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2756625 · Aviso do Fabricante