CVE-2019-0270
Estado: ModificadaAlta (8.8)—
ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.40%
- Percentil entre todas las CVEs puntuadas: 72
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (5)
SAP — Advanced Business Application Programming Platform KernelSAP — Advanced Business Application Programming Platform Krnl32nucSAP — Advanced Business Application Programming Platform Krnl32ucSAP — Advanced Business Application Programming Platform Krnl64nucSAP — Advanced Business Application Programming Platform Krnl64uc
CWE
- CWE-862
Referencias
- http://www.securityfocus.com/bid/107377
- https://launchpad.support.sap.com/#/notes/2727689
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080
- http://www.securityfocus.com/bid/107377
- https://launchpad.support.sap.com/#/notes/2727689
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-0270",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cna@sap.com",
"affectedData": [
{
"vendor": "SAP SE",
"product": "ABAP Platform & Server (KRNL32NUC)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.21EXT"
},
{
"status": "affected",
"version": "< 7.22"
},
{
"status": "affected",
"version": "< 7.22EXT"
}
]
},
{
"vendor": "SAP SE",
"product": "ABAP Platform & Server (KRNL32UC)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.21EXT"
},
{
"status": "affected",
"version": "< 7.22"
},
{
"status": "affected",
"version": "< 7.22EXT"
}
]
},
{
"vendor": "SAP SE",
"product": "ABAP Platform & Server (KRNL64NUC)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.21EXT"
},
{
"status": "affected",
"version": "< 7.22"
},
{
"status": "affected",
"version": "< 7.22EXT"
},
{
"status": "affected",
"version": "< 7.49"
},
{
"status": "affected",
"version": "< 7.74"
}
]
},
{
"vendor": "SAP SE",
"product": "ABAP Platform & Server (KRNL64UC)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.21EXT"
},
{
"status": "affected",
"version": "< 7.22"
},
{
"status": "affected",
"version": "< 7.22EXT"
},
{
"status": "affected",
"version": "< 7.49"
},
{
"status": "affected",
"version": "< 7.73"
},
{
"status": "affected",
"version": "< 7.74"
},
{
"status": "affected",
"version": "< 8.04"
}
]
},
{
"vendor": "SAP SE",
"product": "ABAP Platform & Server (KERNEL)",
"versions": [
{
"status": "affected",
"version": "< 7.21"
},
{
"status": "affected",
"version": "< 7.45"
},
{
"status": "affected",
"version": "< 7.49"
},
{
"status": "affected",
"version": "< 7.53"
},
{
"status": "affected",
"version": "< 7.73"
},
{
"status": "affected",
"version": "< 7.74"
},
{
"status": "affected",
"version": "< 7.75"
},
{
"status": "affected",
"version": "< 8.04"
}
]
}
]
}
],
"published": "2019-03-12T22:29:00.427",
"references": [
{
"url": "http://www.securityfocus.com/bid/107377",
"tags": [
"Third Party Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://launchpad.support.sap.com/#/notes/2727689",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080",
"tags": [
"Vendor Advisory"
],
"source": "cna@sap.com"
},
{
"url": "http://www.securityfocus.com/bid/107377",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://launchpad.support.sap.com/#/notes/2727689",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04."
},
{
"lang": "es",
"value": "El servidor ABAP de SAP NetWeaver y ABAP Platform no realiza correctamente las comprobaciones de autorización necesarias para un usuario autenticado, lo que resulta en un escalado de privilegios. Esto se ha solucionado en las siguientes versiones: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75 y 8.04."
}
],
"lastModified": "2026-06-17T02:08:06.437",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CCC82D3B-082F-4557-9486-68BB961DF06A"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8EBCD0F-ED63-4C55-9DB4-63DE8F0751CA"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D318512C-4F5F-47AD-9F85-1EACCCBF11C0"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.49:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2AFDC66-A5C4-4135-9A7F-1778B9DDF2EE"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.53:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4CB213CC-4C71-4B3A-9D9F-C83594597447"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.73:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46C2954E-3626-4DC7-85CA-241B9E826337"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.74:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F72516A7-737D-407D-A483-E577993868FA"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:7.75:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3087F37A-8D4F-43AC-8E8E-EA7D5E5AF44C"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_kernel:8.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D699689-AEC0-4A19-AC29-7AAE1E4EEA1F"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED21DC1E-A53A-4E92-83F0-7455EBEFA3A1"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.21ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "93910493-4A5E-4E14-B6FD-6A5B175AE664"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F6B9301C-C221-4345-A006-DA7B12E93D1B"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32nuc:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A2B2EC5-A03F-4EBB-BCAF-526DE7EFE2BD"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32uc:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "940B8331-6D22-418A-9D17-B14DAB035FE1"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32uc:7.21ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D191560-7559-4D90-A593-261C4FD6458D"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32uc:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01A83003-D709-4E48-8CBE-2AA40274ADA7"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl32uc:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "471132DF-5B9A-4124-B75F-A09EA02C9CE2"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A50F5C48-173B-487A-8DD1-06A921E37602"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.21ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD2EBEA5-D698-4595-A654-DEA58C948C78"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A901C3A0-E763-4133-9F1F-CDB5AE45A6E2"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64nuc:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE5B551B-0CD5-4800-9A0D-B5B36AD6BCCD"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.21:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9CC9A5B1-F1B2-4804-BABD-2CAEA06BCC42"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.21ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5D40A13-C630-4E43-A44B-76CAB09FF2C1"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.22:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26486715-DC64-4AC6-A60D-01254A75C19C"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.22ext:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6953A3D-8BD4-45DA-A872-6222CB6C1B77"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.49:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C3A6702-3A41-4DA5-B705-AAC77A097AC0"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.73:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80296DDD-A3B9-4A7F-B831-DC064A85CE38"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:7.74:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DFDC7BE-4A75-4C80-8A5C-79699062DB43"
},
{
"criteria": "cpe:2.3:a:sap:advanced_business_application_programming_platform_krnl64uc:8.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BCA6E11C-842E-468F-A3B6-34FF5315B8E7"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cna@sap.com"
}