SAP SE SAP NetWeaver Process Integration (B2B Toolkit)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.55 % · percentile 46 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authenticated user, allowing the import of B2B table content that leads to Missing Authorization Check.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-1140
- GCVE · GCVE-0-2019-0367
CERT-FR advisories
- CERTFR-2019-AVI-514 — Multiples vulnérabilités dans plusieurs produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:netweaver_process_integration:1.0:*:*:*:*:*:*:*cpe:2.3:a:sap:netweaver_process_integration:2.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP SE · SAP NetWeaver Process Integration (B2B Toolkit) | affected < 1.0 ; affected < 2.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |