PT-2019-4259 · Sap · Sap Kernel

Published 2019-08-13 · Updated 2020-08-24 · CVE-2019-0349

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Kernel (ABAP Debugger) versions 7.21 through 7.77

Description The issue is caused by weaknesses in the authorization procedure of the ABAP Debugger. This allows a remote attacker to execute the "Go to statement" command without proper authorization.

Recommendations For SAP Kernel (ABAP Debugger) versions 7.21 through 7.77, ensure that users possess the required authorization S DEVELOP DEBUG 02 to execute the "Go to statement" command. As a temporary workaround, consider restricting access to the ABAP Debugger until a patch is available.

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

BDU:2019-04860

CVE-2019-0349

Affected Products

Sap Kernel

References · 6

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0349 · Security Note
• https://bdu.fstec.ru/vul/2019-04860 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0349 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2798743 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0349 · Note