CVE-2020-6199

5.4MEDIUM

Key Information:

Vendor
SAP
Status
SAP Erp (eappglo)
SAP Erp (SAP Fin)
SAP S/4hana (s4core)
Vendor
CVE Published:
10 March 2020

Summary

The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization Check.

Affected Version(s)

SAP ERP (EAPPGLO) < 607

SAP ERP (SAP_FIN) < 618 < 618

SAP ERP (SAP_FIN) < 730 < 730

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2871167
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.