PT-2019-11215 · Sap · Sap Basis

Published 2019-04-10 · Updated 2020-08-24 · CVE-2019-0279

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP BASIS versions 7.0 through 7.02 SAP BASIS versions 7.10 through 7.30 SAP BASIS versions 7.31 SAP BASIS versions 7.40 SAP BASIS versions 7.50 through 7.53

Description: The issue concerns the ABAP BASIS function modules INST CREATE R3 RFC DEST, INST CREATE TCPIP RFCDEST, and INST CREATE TCPIP RFC DEST in SAP BASIS. These function modules do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.

Recommendations: For SAP BASIS versions 7.0 through 7.02, update to a version outside of this range. For SAP BASIS versions 7.10 through 7.30, update to a version outside of this range. For SAP BASIS version 7.31, update to a version outside of this range. For SAP BASIS version 7.40, update to a version outside of this range. For SAP BASIS versions 7.50 through 7.53, update to a version outside of this range. As a temporary workaround, consider restricting access to the function modules INST CREATE R3 RFC DEST, INST CREATE TCPIP RFCDEST, and INST CREATE TCPIP RFC DEST until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-0279

Affected Products

Sap Basis

References · 4

• https://osv.dev/vulnerability/CVE-2019-0279 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2753629 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0279 · Security Note