{"id":"CVE-2019-0270","aliases":["EUVD-2019-1043","GHSA-p5w4-x3m3-939j"],"status":"published","title":"ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for...","description":"ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01404,"percentile":0.72754,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2019-03-12T22:00:00Z","modified":"2026-06-17T02:08:06Z","products":[{"vendor":"sap","product":"advanced_business_application_programming_platform_kernel"},{"vendor":"sap","product":"advanced_business_application_programming_platform_krnl32nuc"},{"vendor":"sap","product":"advanced_business_application_programming_platform_krnl32uc"},{"vendor":"sap","product":"advanced_business_application_programming_platform_krnl64nuc"},{"vendor":"sap","product":"advanced_business_application_programming_platform_krnl64uc"},{"vendor":"sap se","product":"abap platform \u0026 server (kernel)"},{"vendor":"sap se","product":"abap platform \u0026 server (krnl32nuc)"},{"vendor":"sap se","product":"abap platform \u0026 server (krnl32uc)"},{"vendor":"sap se","product":"abap platform \u0026 server (krnl64nuc)"},{"vendor":"sap se","product":"abap platform \u0026 server (krnl64uc)"}],"references":[{"url":"http://www.securityfocus.com/bid/107377","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=515408080","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2727689","tags":["x_refsource_MISC","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0270"},{"url":"https://github.com/advisories/GHSA-p5w4-x3m3-939j"}],"sources":{"cve":[{"id":"CVE-2019-0270","description":"ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.","status":"published","published":"2019-03-12T22:00:00Z","modified":"2024-08-04T17:44:16.34Z","updated_at":"2026-11-02T14:32:24.473448Z"}],"euvd":[{"id":"EUVD-2019-1043","description":"ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.","status":"published","published":"2019-03-12T22:00:00Z","modified":"2024-08-04T17:44:16Z","updated_at":"2026-11-03T03:07:02.049822Z"}],"ghsa":[{"id":"GHSA-p5w4-x3m3-939j","title":"ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for...","description":"ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.","status":"published","published":"2022-05-13T01:21:12Z","modified":"2023-02-01T05:06:31Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:50:21.781869Z"}],"nvd":[{"id":"CVE-2019-0270","description":"ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has been corrected in the following versions: KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.74, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, 7.74, 8.04, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, 7.74, 7.75, 8.04.","status":"published","published":"2019-03-12T22:29:00.427Z","modified":"2026-06-17T02:08:06.437Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:05:07.268578Z"}]}}