CVE-2019-0257
First published: Fri Feb 15 2019(Updated: )
Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver Application Server ABAP | >=7.0<=7.02 | |
| SAP NetWeaver Application Server ABAP | >=7.50<=7.53 | |
| SAP NetWeaver Application Server ABAP | =7.30 | |
| SAP NetWeaver Application Server ABAP | =7.31 | |
| SAP NetWeaver Application Server ABAP | =7.40 | |
| SAP NetWeaver AS ABAP | >=7.10<=7.11 | |
| SAP NetWeaver AS ABAP | >=7.74<=7.75 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-0257?
CVE-2019-0257 is a vulnerability in SAP NetWeaver AS ABAP Platform that allows an authenticated user to escalate privileges due to a lack of necessary authorization checks.
Which versions of SAP NetWeaver AS ABAP Platform are affected by CVE-2019-0257?
Versions 7.0 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 to 7.53, and 7.74 to 7.75 of SAP NetWeaver AS ABAP Platform are affected by CVE-2019-0257.
What is the severity rating of CVE-2019-0257?
CVE-2019-0257 has a severity rating of 8.8 (high).
How can I fix CVE-2019-0257?
To fix CVE-2019-0257, update your SAP NetWeaver AS ABAP Platform to versions 7.03, 7.12, 7.32, 7.41, 7.54, or 7.76, as they contain the necessary fixes.
Where can I find more information about CVE-2019-0257?
You can find more information about CVE-2019-0257 on the following references: [1] [2] [3].
- collector/nvd-index
- agent/event
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap netweaver application server abap
- version/sap netweaver application server abap/7.0
- version/sap netweaver application server abap/7.02
- version/sap netweaver application server abap/7.50
- version/sap netweaver application server abap/7.53
- version/sap netweaver application server abap/7.30
- version/sap netweaver application server abap/7.31
- version/sap netweaver application server abap/7.40
- canonical/sap netweaver as abap
- version/sap netweaver as abap/7.10
- version/sap netweaver as abap/7.11
- version/sap netweaver as abap/7.74
- version/sap netweaver as abap/7.75