CVE-2019-0325

2019-07-1019:04:13

sap

www.cve.org

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.6%

JSON

SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.

CNA Affected

[
  {
    "product": "SAP ERP HCM (SAP_HRCES) ",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 3"
      }
    ]
  }
]