CVE-2020-6316 - SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check

Back Back to CVE browser

MEDIUM

SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check

Published Nov 10, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.82%

Description

SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check.

Affected products

Vendor SAP SE Product SAP Erp Default
n/a
- Version
  < 600
  Status
  affected
  Constraints
  -
- Version
  < 602
  Status
  affected
  Constraints
  -
- Version
  < 603
  Status
  affected
  Constraints
  -
- Version
  < 604
  Status
  affected
  Constraints
  -
- Version
  < 605
  Status
  affected
  Constraints
  -
- Version
  < 606
  Status
  affected
  Constraints
  -
- Version
  < 616
  Status
  affected
  Constraints
  -
- Version
  < 617
  Status
  affected
  Constraints
  -
- Version
  < 618
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP S/4 Hana Default
n/a
- Version
  < 100
  Status
  affected
  Constraints
  -
- Version
  < 101
  Status
  affected
  Constraints
  -
- Version
  < 102
  Status
  affected
  Constraints
  -
- Version
  < 103
  Status
  affected
  Constraints
  -
- Version
  < 104
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Erp

n/a

Version	Status	Constraints
< 600	affected	-
< 602	affected	-
< 603	affected	-
< 604	affected	-
< 605	affected	-
< 606	affected	-
< 616	affected	-
< 617	affected	-
< 618	affected	-

SAP SE

SAP S/4 Hana

n/a

Version	Status	Constraints
< 100	affected	-
< 101	affected	-
< 102	affected	-
< 103	affected	-
< 104	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27466
Advisory
https://launchpad.support.sap.com/#/notes/2944188
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27466		Advisory
https://launchpad.support.sap.com/#/notes/2944188		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571		x_refsource_MISCVendor Advisory