Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

CVE-2019-0399 Potential Information Disclosure in SAP Portfolio and Project Management, SAP security note 2803554

Description

A malicious user without necessary authorization can discover accounting information of the Projects in Project dashboard.

Available fix and Supported packages

  • S4CORE | 102 | 102
  • S4CORE | 103 | 103
  • EPPM | 100 | 100
  • CPRXRPM | 500_702 | 500_702
  • CPRXRPM | 600_740 | 600_740
  • CPRXRPM | 610_740 | 610_740
  • | SAPK-S4CLOUD_1911 |
  • S4CORE 102 | SAPK-10205INS4CORE |
  • S4CORE 103 | SAPK-10303INS4CORE |
  • EPPM 100 | SAPK-10007INEPPM |
  • CPRXRPM 500_702 | SAPK-50023INCPRXRPM |
  • CPRXRPM 600_740 | SAPK-60017INCPRXRPM |
  • CPRXRPM 610_740 | SAPK-61013INCPRXRPM |

Affected component

    PPM-PRO
    Project Management

CVSS

Score: 5.3
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2803554

TAGS

#Information-Exposure
#Information-Leak
#&160-CVE-2019-0399

Explore More

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.