CVE-2019-0386

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-13 · updated 2026-06-17
Weakness: CWE-862

Description

Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA Sales (corrected in S4CORE 1.0, 1.01, 1.02, 1.03, 1.04) does not execute the required authorization checks for an authenticated user, which can result in an escalation of privileges.

Affected products

SAP Erp Sales: 6.0, 6.02, 6.03, 6.04, 6.05, 6.06 (+3)
SAP S4Hana Sales: 1.0, 1.01, 1.02, 1.03, 1.04

References

https://launchpad.support.sap.com/#/notes/2840520
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390
https://launchpad.support.sap.com/#/notes/2840520
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390

Get alerted when CVE-2019-0386 or the next vulnerability affects your stack