CVEvulnerability

CVE-2020-6204

4.3 MEDIUM Published 2020-03-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.0 ([email protected])
4.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-862

Description

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.

Affected configurations

• sap treasury and risk management \(ea-finserv\) 600 • sap treasury and risk management \(ea-finserv\) 603 • sap treasury and risk management \(ea-finserv\) 604 • sap treasury and risk management \(ea-finserv\) 605 • sap treasury and risk management \(ea-finserv\) 606 • sap treasury and risk management \(ea-finserv\) 616 • sap treasury and risk management \(ea-finserv\) 617 • sap treasury and risk management \(ea-finserv\) 618 • sap treasury and risk management \(ea-finserv\) 800 • sap treasury and risk management \(s4core\) 101 • sap treasury and risk management \(s4core\) 102 • sap treasury and risk management \(s4core\) 103 • sap treasury and risk management \(s4core\) 104

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References