Authorization Check Bypass in SAP ERP Statutory Reporting
CVE-2020-6268

5.4MEDIUM

Key Information:

Vendor
SAP
Status
SAP Erp (statutory Reporting For Insurance Companies)
Vendor
CVE Published:
10 June 2020

Summary

The Statutory Reporting component of SAP ERP is vulnerable due to the absence of essential authorization checks for authenticated users. This flaw allows attackers to access and manipulate sensitive data that should be restricted, leading to potential data integrity issues. It primarily affects several versions of the EA-FINSERV and S4CORE products, making it critical for organizations to address this vulnerability to protect their data and maintain compliance.

Affected Version(s)

SAP ERP (Statutory Reporting for Insurance Companies) < EA-FINSERV 600 < EA-FINSERV 600

SAP ERP (Statutory Reporting for Insurance Companies) < 603 < 603

SAP ERP (Statutory Reporting for Insurance Companies) < 604 < 604

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2906996
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.