Missing authorization in SAP Treasury and Risk Management
Priority MEDIUM 40CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.
Why it matters now
EPSS 0.0112 66th percentileScored 2026-11-07
Fix Fixed SAP Treasury and Risk Management(EA-FINSERV) (SAP SE): 6.0, 6.03, 6.04 +6SAP Enterprise Financial Services (S4CORE) (SAP SE): 1.01, 1.02, 1.03
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Treasury and Risk Management(EA-FINSERV) | before 6.0; before 6.03; before 6.04; before 6.05; before 6.06; before 6.16; before 6.17; before 6.18; before 8.0 | 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 | Patch available | CNA |
| SAP | SAP Enterprise Financial Services (S4CORE) | before 1.01; before 1.02; before 1.03 | 1.01, 1.02, 1.03 | Patch available | CNA |
- SAP Treasury and Risk Management(EA-FINSERV) VendorSAP Affected before 6.0; before 6.03; before 6.04; before 6.05; before 6.06; before 6.16; before 6.17; before 6.18; before 8.0 Fixed in 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 Patch available CNA
- SAP Enterprise Financial Services (S4CORE) VendorSAP Affected before 1.01; before 1.02; before 1.03 Fixed in 1.01, 1.02, 1.03 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:treasury_and_risk_management:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management:6.03:*:*:*:*:*:*:* | 6.03 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management:6.04:*:*:*:*:*:*:* | 6.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management:6.05:*:*:*:*:*:*:* | 6.05 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management:6.06:*:*:*:*:*:*:* | 6.06 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management:6.16:*:*:*:*:*:*:* | 6.16 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management:6.17:*:*:*:*:*:*:* | 6.17 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management:6.18:*:*:*:*:*:*:* | 6.18 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | SAP |
- cpe:2.3:a:sap:treasury_and_risk_management:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management:6.03:*:*:*:*:*:*:* Versions 6.03 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management:6.04:*:*:*:*:*:*:* Versions 6.04 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management:6.05:*:*:*:*:*:*:* Versions 6.05 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management:6.16:*:*:*:*:*:*:* Versions 6.16 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management:6.17:*:*:*:*:*:*:* Versions 6.17 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management:6.18:*:*:*:*:*:*:* Versions 6.18 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Treasury and Risk Management(EA-FINSERV) (SAP SE) Fixed in 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0
- Fix · CNA SAP Enterprise Financial Services (S4CORE) (SAP SE) Fixed in 1.01, 1.02, 1.03
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0280
- 2026-10-03 Alias added: GHSA-2pvf-hwww-4v9q
References
Sources
- CVE-2019-0280 · CVE Program
- CVE-2019-0280 · NVD
- FIRST EPSS
- GHSA-2pvf-hwww-4v9q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences