« Volver al listado

CVE-2019-0383

Estado: ModificadaAlta (8.8)—

Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

SAP — Enterprise Extension Financial ServicesSAP — Treasury AND Risk Management (s4core)

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-0383",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Treasury and Risk Management (S4CORE)",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.01"
            },
            {
              "status": "affected",
              "version": "< 1.02"
            },
            {
              "status": "affected",
              "version": "< 1.03"
            },
            {
              "status": "affected",
              "version": "< 1.04"
            }
          ]
        },
        {
          "vendor": "SAP SE",
          "product": "SAP Treasury and Risk Management (EA-FINSERV)",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.0"
            },
            {
              "status": "affected",
              "version": "< 6.03"
            },
            {
              "status": "affected",
              "version": "< 6.04"
            },
            {
              "status": "affected",
              "version": "< 6.05"
            },
            {
              "status": "affected",
              "version": "< 6.06"
            },
            {
              "status": "affected",
              "version": "< 6.16"
            },
            {
              "status": "affected",
              "version": "< 6.17"
            },
            {
              "status": "affected",
              "version": "< 6.18"
            },
            {
              "status": "affected",
              "version": "< 8.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-17T20:15:11.227",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2819170",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2819170",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges."
    },
    {
      "lang": "es",
      "value": "Transaction Management en SAP Treasury and Risk Management (corregida en S4CORE versiones 1.01, 1.02, 1.03, 1.04 y EA-FINSERV versiones 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0), no realiza las comprobaciones de autorización necesarias para un usuario autenticado, resultando en una escalada de privilegios."
    }
  ],
  "lastModified": "2026-06-17T02:08:15.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C94735B-99F4-4B0A-A985-5FE3CD7B8B29"
            },
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9139751-0E66-45DD-B0CA-8C75AF762E43"
            },
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AC27183-F4D9-430F-884A-A51DC39D9360"
            },
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7E3267E-9458-473B-8001-2762F4753784"
            },
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "207E235D-3641-4FBD-A165-2D030EBFB1FE"
            },
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3726192A-1582-4936-AC2B-7DCBCB6C73C2"
            },
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DAC779F-945A-4F55-B23F-6BF46047A128"
            },
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "796D38E2-78CF-4285-AF7C-BBB3C0BC7ED2"
            },
            {
              "criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B601CCAE-2499-4F24-8C85-C28EA2A0486F"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA33418A-B177-4899-9859-E41CC01A97FC"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "720812DB-4460-4059-AAD9-C638E71684B0"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EB10799-4688-446B-8D56-B944AD1B8535"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "083941A4-561C-4AF8-B1CE-064E481D1921"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}