CVE-2019-0279

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-10 · updated 2026-06-17
Weakness: CWE-862

Description

ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BASIS (fixed in versions 7.0 to 7.02, 7.10 to 7.30, 7.31, 7.40, 7.50 to 7.53) do not perform necessary authorization checks in all circumstances for an authenticated user, resulting in escalation of privileges.

Affected products

SAP Business Application Software Integrated Solution: from 7.00 through 7.02; from 7.10 through 7.30; from 7.50 through 7.53; 7.31, 7.40

References

https://launchpad.support.sap.com/#/notes/2753629
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114
https://launchpad.support.sap.com/#/notes/2753629
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114

Get alerted when CVE-2019-0279 or the next vulnerability affects your stack