Insufficient Session Expiration in SAP Disclosure Management by SAP
CVE-2020-6292

4.6MEDIUM

Key Information:

Vendor
SAP
Status
SAP Disclosure Management
Vendor
CVE Published:
14 July 2020

Summary

The logout mechanism in SAP Disclosure Management version 10.1 fails to invalidate a session cookie effectively. This oversight can enable malicious users to exploit active sessions, potentially leading to unauthorized access and data breaches. It is crucial for organizations using this product to implement additional security measures to mitigate risks associated with session handling and ensure that session cookies are adequately invalidated upon user logout.

Affected Version(s)

SAP Disclosure Management < 1.0

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2758000
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.