CVE-2020-6249

7.7HIGH

Key Information:

Vendor
SAP
Status
SAP Master Data Governance (s4core)
SAP Master Data Governance (s4fnd)
SAP Master Data Governance (SAP Bs Fnd)
Vendor
CVE Published:
12 May 2020

Summary

The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.

Affected Version(s)

SAP Master Data Governance (S4CORE) < 101

SAP Master Data Governance (S4FND) < 102 < 102

SAP Master Data Governance (S4FND) < 103 < 103

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2908560
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.