CVE-2020-6239 - Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure

Back Back to CVE browser

MEDIUM

Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure

Published Jun 10, 2020

4.4

MEDIUM

CVSS 3.1

EPSS 0.32%

Description

Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure.

Affected products

Vendor SAP SE Product SAP Business One (Backup service) Default
n/a
- Version
  < 10.0
  Status
  affected
  Constraints
  -
- Version
  < 9.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Business One (Backup service)

n/a

Version	Status	Constraints
< 10.0	affected	-
< 9.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27389
Advisory
https://launchpad.support.sap.com/#/notes/2908382
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27389		Advisory
https://launchpad.support.sap.com/#/notes/2908382		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775		x_refsource_MISCVendor Advisory