4.3med
CVE-2019-0367
SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authen…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
4.3
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 46%
Public exploits
0
none known
Summary
SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.
Exploit prediction (EPSS)
0.55% probability of exploitation in the next 30 days, higher than 46% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Affected products
- SAP SE SAP NetWeaver Process Integration (B2B Toolkit)
Classification
- Weakness
- CWE-862 Missing Authorization
References
- launchpad.support.sap.com /#/notes/2805777 · x_refsource_MISC, x_transferred
- wiki.scn.sap.com /wiki/pages/viewpage.action?pageId=528123050 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2019-0367
- NVD: CVE-2019-0367
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.