CVE-2019-0280

HIGH

SAP Treasury and Risk Management - Missing Authorization for T_DEAL_DP and T_DEAL_PD

Title source: llm
STIX 2.1

Description

SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.

References (2)

Core 2
Core References
Permissions Required x_refsource_misc
https://launchpad.support.sap.com/#/notes/2744937

Scores

CVSS v3 8.8
EPSS 0.0038
EPSS Percentile 59.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-862
Status published
Products (9)
sap/treasury_and_risk_management 6.0
sap/treasury_and_risk_management 6.03
sap/treasury_and_risk_management 6.04
sap/treasury_and_risk_management 6.05
sap/treasury_and_risk_management 6.06
sap/treasury_and_risk_management 6.16
sap/treasury_and_risk_management 6.17
sap/treasury_and_risk_management 6.18
sap/treasury_and_risk_management 8.0
Published May 14, 2019
Tracked Since Feb 18, 2026