Read the docs
TI-2019-00252 Aliases CVE-2019-0301GHSA-c78m-cj58-772c

Improper privilege management in SAP Identity Management

Priority MEDIUM 40CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-269.

Summary

Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2, which would otherwise be restricted only for viewing.

Why it matters now

EPSS 0.0111 66th percentileScored 2026-11-07
Fix Fixed SAP Identity Management (REST Interface) (SAP SE): 2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Identity Management (REST Interface)before 22Patch availableCNA
  • SAP Identity Management (REST Interface) VendorSAP Affected before 2 Fixed in 2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:identity_management:2.0:*:*:*:*:*:*:*2.0VulnerableSAP
  • cpe:2.3:a:sap:identity_management:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Identity Management (REST Interface) (SAP SE) Fixed in 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0301
  2. 2026-10-03 Alias added: GHSA-c78m-cj58-772c

References

Advisory 2

  • TI-2020-05113 Missing authorization in SAP Identity Management CVSS 3.1MEDIUM 6.5
  • TI-2018-01802 Under certain conditions, the SAP Identity Management 8.0 (pass of type ToASCII) allows… CVSS 3.0MEDIUM 5.3
  • TI-2018-01801 SAP Identity Management 7.2 and 8.0 do not sufficiently validate an XML document accepted from an untrusted source. CVSS 3.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences