CVE-2019-0257

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-15 · updated 2026-06-17
Weakness: CWE-862

Description

Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Affected products

SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: from 7.0 through 7.02; from 7.50 through 7.53; 7.30, 7.31, 7.40
SAP SE SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server): from 7.10 through 7.11; from 7.74 through 7.75

References

http://www.securityfocus.com/bid/106999
https://launchpad.support.sap.com/#/notes/2728839
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943
http://www.securityfocus.com/bid/106999
https://launchpad.support.sap.com/#/notes/2728839
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=510922943

Get alerted when CVE-2019-0257 or the next vulnerability affects your stack