7.8
CVE-2020-6244
- EPSS 0.34%
- Veröffentlicht 12.05.2020 18:15:13
- Zuletzt bearbeitet 27.05.2025 16:50:33
- Erkennungen
LoginSAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Business Client Version 6.0 Update -
SAP ≫ Business Client Version 6.0 Update patch_level1
SAP ≫ Business Client Version 6.0 Update patch_level10
SAP ≫ Business Client Version 6.0 Update patch_level11
SAP ≫ Business Client Version 6.0 Update patch_level12
SAP ≫ Business Client Version 6.0 Update patch_level13
SAP ≫ Business Client Version 6.0 Update patch_level14
SAP ≫ Business Client Version 6.0 Update patch_level15
SAP ≫ Business Client Version 6.0 Update patch_level16
SAP ≫ Business Client Version 6.0 Update patch_level17
SAP ≫ Business Client Version 6.0 Update patch_level2
SAP ≫ Business Client Version 6.0 Update patch_level3
SAP ≫ Business Client Version 6.0 Update patch_level4
SAP ≫ Business Client Version 6.0 Update patch_level5
SAP ≫ Business Client Version 6.0 Update patch_level6
SAP ≫ Business Client Version 6.0 Update patch_level7
SAP ≫ Business Client Version 6.0 Update patch_level8
SAP ≫ Business Client Version 6.0 Update patch_level9
SAP ≫ Business Client Version 6.5 Update -
SAP ≫ Business Client Version 6.5 Update patch_level1
SAP ≫ Business Client Version 6.5 Update patch_level10
SAP ≫ Business Client Version 6.5 Update patch_level11
SAP ≫ Business Client Version 6.5 Update patch_level12
SAP ≫ Business Client Version 6.5 Update patch_level13
SAP ≫ Business Client Version 6.5 Update patch_level14
SAP ≫ Business Client Version 6.5 Update patch_level15
SAP ≫ Business Client Version 6.5 Update patch_level16
SAP ≫ Business Client Version 6.5 Update patch_level17
SAP ≫ Business Client Version 6.5 Update patch_level18
SAP ≫ Business Client Version 6.5 Update patch_level19
SAP ≫ Business Client Version 6.5 Update patch_level2
SAP ≫ Business Client Version 6.5 Update patch_level20
SAP ≫ Business Client Version 6.5 Update patch_level21
SAP ≫ Business Client Version 6.5 Update patch_level22
SAP ≫ Business Client Version 6.5 Update patch_level3
SAP ≫ Business Client Version 6.5 Update patch_level4
SAP ≫ Business Client Version 6.5 Update patch_level5
SAP ≫ Business Client Version 6.5 Update patch_level6
SAP ≫ Business Client Version 6.5 Update patch_level7
SAP ≫ Business Client Version 6.5 Update patch_level8
SAP ≫ Business Client Version 6.5 Update patch_level9
SAP ≫ Business Client Version 7.0 Update -
SAP ≫ Business Client Version 7.0 Update patch_level1
SAP ≫ Business Client Version 7.0 Update patch_level2
SAP ≫ Business Client Version 7.0 Update patch_level3
SAP ≫ Business Client Version 7.0 Update patch_level4
SAP ≫ Business Client Version 7.0 Update patch_level5
SAP ≫ Business Client Version 7.0 Update patch_level6
SAP ≫ Business Client Version 7.0 Update patch_level7
SAP ≫ Business Client Version 7.0 Update patch_level8
SAP ≫ Business Client Version 7.0 Update patch_level9
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.34% | 0.263 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| NIST | 4.4 | 3.4 | 6.4 |
AV:L/AC:M/Au:N/C:P/I:P/A:P
|
| SAP | 7 | 1 | 5.9 |
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
|
CWE-427 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222
https://launchpad.support.sap.com/#/notes/2911801