PT-2019-4585 · Sap · Sap Erp Hcm

Publicado 2019-07-09 · Atualizado 2020-08-24 · CVE-2019-0325

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP ERP HCM (SAP HRCES) version 3

Description The issue arises from insufficient authorization checks in a report that reads payroll data of employees in a certain area. This can lead to a situation where a user who once had authorization to payroll data, but later had it revoked, may still retain access to the same data. The vulnerability is caused by weaknesses in the authorization procedure, which can be exploited by a remote attacker to elevate their privileges.

Recommendations For SAP ERP HCM (SAP HRCES) version 3, consider implementing additional authorization checks for the report that reads payroll data to prevent unauthorized access. As a temporary workaround, restrict access to the payroll data report until a proper fix is applied.

Correção

Improper Authorization

Missing Authorization

Enumeração de Fraquezas

CWE-285

CWE-862

Identificadores relacionados

BDU:2020-00645

CVE-2019-0325

Produtos afetados

Sap Erp Hcm

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-0325 · Nota de Segurança
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00645 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2798133 · Aviso do Fabricante
• http://securityfocus.com/bid/109075 · Nota
• https://osv.dev/vulnerability/CVE-2019-0325 · Aviso do Fabricante