CVE-2019-0399

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-11 · updated 2026-06-17

Description

SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discover accounting information of the Projects in Project dashboard, leading to Information Disclosure.

Affected products

SAP Portfolio And Project Management: cprxrpm_500_702, cprxrpm_600_740, cprxrpm_610_740, eppm_100, s4core_102, s4core_103

References

https://launchpad.support.sap.com/#/notes/2803554
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533660397
https://launchpad.support.sap.com/#/notes/2803554
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533660397

Get alerted when CVE-2019-0399 or the next vulnerability affects your stack