CVE-2019-0384
HIGHSAP Treasury and Risk Management - Incorrect Authorization
Title source: llmDescription
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2828981
Scores
CVSS v3
8.8
EPSS
0.0033
EPSS Percentile
56.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-863
Status
published
Products (13)
sap/enterprise_extension_financial_services
6.0
sap/enterprise_extension_financial_services
6.03
sap/enterprise_extension_financial_services
6.04
sap/enterprise_extension_financial_services
6.05
sap/enterprise_extension_financial_services
6.06
sap/enterprise_extension_financial_services
6.16
sap/enterprise_extension_financial_services
6.17
sap/enterprise_extension_financial_services
6.18
sap/enterprise_extension_financial_services
8.0
sap/treasury_and_risk_management_\(s4core\)
1.01
... and 3 more
Published
Dec 17, 2019
Tracked Since
Feb 18, 2026