CVE-2020-6301 - SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settle trips, resulting in escalation of privileges, due to Missing Authorization Check

Back Back to CVE browser

HIGH

SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settle trips, resulting in escalation of privileges, due to Missing Authorization Check

Published Aug 12, 2020

8.1

HIGH

CVSS 3.1

EPSS 0.71%

Description

SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settle trips, resulting in escalation of privileges, due to Missing Authorization Check.

Affected products

Vendor SAP SE Product SAP ERP (HCM Travel Management) Default
n/a
- Version
  < 600
  Status
  affected
  Constraints
  -
- Version
  < 602
  Status
  affected
  Constraints
  -
- Version
  < 603
  Status
  affected
  Constraints
  -
- Version
  < 604
  Status
  affected
  Constraints
  -
- Version
  < 605
  Status
  affected
  Constraints
  -
- Version
  < 606
  Status
  affected
  Constraints
  -
- Version
  < 607
  Status
  affected
  Constraints
  -
- Version
  < 608
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP ERP (HCM Travel Management)

n/a

Version	Status	Constraints
< 600	affected	-
< 602	affected	-
< 603	affected	-
< 604	affected	-
< 605	affected	-
< 606	affected	-
< 607	affected	-
< 608	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27451
Advisory
https://launchpad.support.sap.com/#/notes/2949196
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27451		Advisory
https://launchpad.support.sap.com/#/notes/2949196		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345		x_refsource_MISCVendor Advisory