CVE-2019-0365

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73 and KERNEL before versions 7.21, 7.49, 7.53, 7.73, 7.76 SAP GUI for Windows (BC-FES-GUI) before versions 7.5, 7.6, and SAP GUI for Java (BC-FES-JAV) before version 7.5, allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
SAP SE	SAP Kernel (KRNL32NUC)	< 7.21; < 7.21EXT; < 7.22; < 7.22EXT
SAP SE	SAP Kernel (KRNL32UC)	< 7.21; < 7.21EXT; < 7.22; < 7.22EXT
SAP SE	SAP Kernel (KRNL64NUC)	< 7.21; < 7.21EXT; < 7.22; < 7.22EXT; < 7.49
SAP SE	SAP Kernel (KRNL64UC)	< 7.21; < 7.21EXT; < 7.22; < 7.22EXT; < 7.49; < 7.73
SAP SE	SAP Kernel (KERNEL)	< 7.21; < 7.49; < 7.53; < 7.73; < 7.76
SAP SE	SAP GUI for Windows (BC-FES-GUI)	< 7.5; < 7.6
SAP SE	SAP GUI for Java (BC-FES-JAV)	< 7.5

References

https://launchpad.support.sap.com/#/notes/2786151Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506Vendor Advisory
https://launchpad.support.sap.com/#/notes/2786151Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=525962506Vendor Advisory

Timeline

Published: Sep 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-03674.3SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authent CVE-2019-03685.4SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7 CVE-2019-03695.4SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to CVE-2019-03706.5Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to int CVE-2019-03745.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03755.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03765.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc CVE-2019-03775.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user CVE-2019-03785.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-CVE-2019-03795.3SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default sec CVE-2019-03804.9Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values t CVE-2019-03815.5A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0,