Insufficient Session Management in SAP Disclosure Management 10.1

CVE-2020-6291

Summary

In SAP Disclosure Management version 10.1, the session management mechanism lacks an expiration configuration. This oversight permits continuous access to the application once the user has authenticated, failing to terminate sessions appropriately. As a result, it poses significant security risks as unauthorized individuals could exploit this persistence and gain access without needing to re-authenticate.

References