CVEvulnerability

CVE-2020-6268

8.1 HIGH Published 2020-06-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-06-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0 ([email protected])
5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
Weaknesses
CWE-862

Description

Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.

Affected configurations

• sap erp \(ea-finserv\) 600 • sap erp \(ea-finserv\) 603 • sap erp \(ea-finserv\) 604 • sap erp \(ea-finserv\) 605 • sap erp \(ea-finserv\) 606 • sap erp \(ea-finserv\) 616 • sap erp \(ea-finserv\) 617 • sap erp \(ea-finserv\) 618 • sap erp \(ea-finserv\) 800 • sap erp \(s4core\) 101 • sap erp \(s4core\) 102 • sap erp \(s4core\) 103 • sap erp \(s4core\) 104

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References