CVEvulnerability

CVE-2019-0386

6.3 MEDIUM Published 2019-11-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-11-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-862

Description

Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges.

Affected configurations

• sap erp sales 6.0 • sap erp sales 6.02 • sap erp sales 6.03 • sap erp sales 6.04 • sap erp sales 6.05 • sap erp sales 6.06 • sap erp sales 6.16 • sap erp sales 6.17 • sap erp sales 6.18 • sap s4hana sales 1.0 • sap s4hana sales 1.01 • sap s4hana sales 1.02 • sap s4hana sales 1.03 • sap s4hana sales 1.04

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References