CVE-2020-6268

5.4MEDIUM

Key Information:

Vendor
SAP
Status
SAP Erp (statutory Reporting For Insurance Companies)
Vendor
CVE Published:
10 June 2020

Summary

Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.

Affected Version(s)

SAP ERP (Statutory Reporting for Insurance Companies) < EA-FINSERV 600 < EA-FINSERV 600

SAP ERP (Statutory Reporting for Insurance Companies) < 603 < 603

SAP ERP (Statutory Reporting for Insurance Companies) < 604 < 604

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2906996
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.