Auth bypass in Sap Advanced Business Application Programming Platform Kernel
CVE-2019-0349
SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check
Vulnerability class: Broken Access Control
EPSS: 0.012 (66.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sap Advanced_business_application_programming_platform_kernel — versions 7.21, 7.21ext, 7.22
- Sap Se Kernel (Kernel) — versions < 7.21, < 7.49, < 7.53
- Sap Se Kernel (Krnl32nuc) — versions < 7.21, < 7.21EXT, < 7.22
- Sap Se Kernel (Krnl32uc) — versions < 7.21, < 7.21EXT, < 7.22
- Sap Se Kernel (Krnl64nuc) — versions < 7.21, < 7.21EXT, < 7.22
- Sap Se Kernel (Krnl64uc) — versions < 7.21, < 7.21EXT, < 7.22
Weakness classification (CWE)
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-0349?
- CVE-2019-0349 is a high-severity vulnerability in Sap Advanced Business Application Programming Platform Kernel, classified under Missing Authorization. CVSS score: 7.2/10. Published 2019-08-14.
- How severe is CVE-2019-0349?
- High severity. CVSS v3 base score is 7.2 out of 10.