Data Exposure in SAP Treasury and Risk Management by SAP
CVE-2020-6204

4.3MEDIUM

Key Information:

Vendor
SAP
Status
SAP Treasury And Risk Management (transaction Management) (ea-finserv)
SAP Treasury And Risk Management (transaction Management) (s4core)
Vendor
CVE Published:
10 March 2020

Summary

A critical issue in SAP Treasury and Risk Management (Transaction Management) allows for an excessive number of records to be returned during query operations when displaying contract numbers. This results in a lack of proper authorization checks, potentially exposing sensitive data to unauthorized users. The impact spans multiple versions of EA-FINSERV and S4CORE, necessitating immediate action to mitigate security risks.

Affected Version(s)

SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) < 600 < 600

SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) < 603 < 603

SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) < 604 < 604

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2841874
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.