Missing authorization in SAP Solution Manager system
Priority LOW 32CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740).
Why it matters now
EPSS 0.01432 73rd percentileScored 2026-11-07
Fix Fixed SAP Solution Manager system (ST-PI) (SAP SE): 2008_1_700, 2008_1_710, 7.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Solution Manager system (ST-PI) | before 2008_1_700; before 2008_1_710; before 7.4 | 2008_1_700, 2008_1_710, 7.4 | Patch available | CNA |
- SAP Solution Manager system (ST-PI) VendorSAP Affected before 2008_1_700; before 2008_1_710; before 7.4 Fixed in 2008_1_700, 2008_1_710, 7.4 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:sap_solution_manager_system:2008_1_700:*:*:*:*:*:*:* | 2008_1_700 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_solution_manager_system:2008_1_710:*:*:*:*:*:*:* | 2008_1_710 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_solution_manager_system:2008_1_740:*:*:*:*:*:*:* | 2008_1_740 | Vulnerable | SAP |
- cpe:2.3:a:sap:sap_solution_manager_system:2008_1_700:*:*:*:*:*:*:* Versions 2008_1_700 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_solution_manager_system:2008_1_710:*:*:*:*:*:*:* Versions 2008_1_710 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_solution_manager_system:2008_1_740:*:*:*:*:*:*:* Versions 2008_1_740 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Solution Manager system (ST-PI) (SAP SE) Fixed in 2008_1_700, 2008_1_710, 7.4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0293
- 2026-10-03 Alias added: GHSA-mfmp-hpg9-83ch
References
Sources
- CVE-2019-0293 · CVE Program
- CVE-2019-0293 · NVD
- FIRST EPSS
- GHSA-mfmp-hpg9-83ch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences