Vulnerabilities > CVE-2019-0325 - Missing Authorization vulnerability in SAP ERP HCM 3.0

047910
CVSS 4.2 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
LOW
Confidentiality impact
LOW
Integrity impact
LOW
Availability impact
NONE
network
high complexity
sap
CWE-862
NVD
Published: 2019-07-10
Updated: 2024-11-21

Summary

SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.

Vulnerable Configurations

Part Description Count
Application
Sap
1

Common Weakness Enumeration (CWE)

References