Missing authorization in SAP ABAP Platform
Priority MEDIUM 41CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from 7.74 to 7.75) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Why it matters now
EPSS 0.0139 72nd percentileScored 2026-11-07
Fix Fixed ABAP Platform(SAP Basis) (SAP SE): 7.30, 7.31, 7.40
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | ABAP Platform(SAP Basis) | < from 7.0 to 7.02; < from 7.10 to 7.11; before 7.30; before 7.31; before 7.40; < from 7.50 to 7.53; < from 7.74 to 7.75 | 7.30, 7.31, 7.40 | Patch available | CNA |
- ABAP Platform(SAP Basis) VendorSAP Affected < from 7.0 to 7.02; < from 7.10 to 7.11; before 7.30; before 7.31; before 7.40; < from 7.50 to 7.53; < from 7.74 to 7.75 Fixed in 7.30, 7.31, 7.40 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_application_server_abap:*:*:*:*:*:*:*:* | 7.0 – 7.02; 7.50 – 7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:7.30:*:*:*:*:*:*:* | 7.30 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:7.31:*:*:*:*:*:*:* | 7.31 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:7.40:*:*:*:*:*:*:* | 7.40 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:*:*:*:*:*:*:*:* | 7.10 – 7.11; 7.74 – 7.75 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_application_server_abap:*:*:*:*:*:*:*:* Versions 7.0 – 7.02; 7.50 – 7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:7.30:*:*:*:*:*:*:* Versions 7.30 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:7.31:*:*:*:*:*:*:* Versions 7.31 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:7.40:*:*:*:*:*:*:* Versions 7.40 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:*:*:*:*:*:*:*:* Versions 7.10 – 7.11; 7.74 – 7.75 Vulnerable ·SAP
Remediation
- Fix · CNA ABAP Platform(SAP Basis) (SAP SE) Fixed in 7.30, 7.31, 7.40
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0257
- 2026-10-03 Alias added: GHSA-xg34-8qvc-j4hh
References
More SAP Netweaver Application Server Abap vulnerabilities
- TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
- TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
- TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
- TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
- TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
- TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-0257 · CVE Program
- CVE-2019-0257 · NVD
- FIRST EPSS
- GHSA-xg34-8qvc-j4hh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences