PT-2019-4464 · Sap · Sap Netweaver Application Server Java

Published 2019-11-12 · Updated 2020-08-24 · CVE-2019-0389

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java versions prior to 7.1 SAP NetWeaver Application Server Java versions prior to 7.2 SAP NetWeaver Application Server Java versions prior to 7.3 SAP NetWeaver Application Server Java versions prior to 7.31 SAP NetWeaver Application Server Java versions prior to 7.4 SAP NetWeaver Application Server Java versions prior to 7.5

Description The issue is related to insecure privilege management in the SAP NetWeaver Application Server Java. Exploitation of this issue could allow a remote attacker to elevate their privileges. An administrator of the SAP NetWeaver Application Server Java may change privileges for all or some functions in the Java Server, enabling users to execute functions they are not otherwise allowed to execute.

Recommendations For versions prior to 7.1, update to version 7.1 or later. For versions prior to 7.2, update to version 7.2 or later. For versions prior to 7.3, update to version 7.3 or later. For versions prior to 7.31, update to version 7.31 or later. For versions prior to 7.4, update to version 7.4 or later. For versions prior to 7.5, update to version 7.5 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-00251

CVE-2019-0389

Affected Products

Sap Netweaver Application Server Java

References · 5

• https://osv.dev/vulnerability/CVE-2019-0389 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2814357 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0389 · Security Note
• https://bdu.fstec.ru/vul/2020-00251 · Security Note