CVE-2019-0386
MEDIUMSAP ERP Sales and S4HANA Sales - Missing Authorization in Order Processing
Title source: llmDescription
Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2840520
Scores
CVSS v3
6.3
EPSS
0.0025
EPSS Percentile
48.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-862
Status
published
Products (14)
sap/erp_sales
6.0
sap/erp_sales
6.02
sap/erp_sales
6.03
sap/erp_sales
6.04
sap/erp_sales
6.05
sap/erp_sales
6.06
sap/erp_sales
6.16
sap/erp_sales
6.17
sap/erp_sales
6.18
sap/s4hana_sales
1.0
... and 4 more
Published
Nov 13, 2019
Tracked Since
Feb 18, 2026