PT-2019-11222 · Sap · Sap Solution Manager

Published 2019-05-14 · Updated 2020-08-24 · CVE-2019-0293

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP Solution Manager system (ST-PI) versions prior to 2008 1 700 SAP Solution Manager system (ST-PI) versions prior to 2008 1 710 SAP Solution Manager system (ST-PI) version prior to 740

Description: The issue is related to the read of RFC destination, which does not always perform necessary authorization checks. This results in escalation of privileges to access information on RFC destinations on managed systems and the SAP Solution Manager system.

Recommendations: For SAP Solution Manager system (ST-PI) versions prior to 2008 1 700, update to version 2008 1 700 or later. For SAP Solution Manager system (ST-PI) versions prior to 2008 1 710, update to version 2008 1 710 or later. For SAP Solution Manager system (ST-PI) version prior to 740, update to version 740 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-0293

Affected Products

Sap Solution Manager

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0293 · Security Note
• https://launchpad.support.sap.com/#/notes/2756625 · Vendor Advisory
• http://securityfocus.com/bid/108324 · Note