CVE-2019-0325

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain access to the same data.

Metrics

CVSS 3.0 4.2/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP SE	SAP ERP HCM (SAP_HRCES)	< 3

References

http://www.securityfocus.com/bid/109075Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2798133Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575Vendor Advisory
http://www.securityfocus.com/bid/109075Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2798133Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575Vendor Advisory

Timeline

Published: Jul 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-03266.1SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-co CVE-2019-03277.2SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2 CVE-2019-03287.2ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the executio CVE-2019-03296.1SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabi CVE-2019-03309.1The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an att CVE-2019-03315.3Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to a CVE-2019-03326.1SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword CVE-2019-03336.5In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.CVE-2019-03345.4When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store CVE-2019-03356.1Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an CVE-2019-03376.1Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-cont CVE-2019-03385.3During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not prop