8.1

CVE-2020-6268

Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Erp (ea-finserv) Version 600
SAP ≫ Erp (ea-finserv) Version 603
SAP ≫ Erp (ea-finserv) Version 604
SAP ≫ Erp (ea-finserv) Version 605
SAP ≫ Erp (ea-finserv) Version 606
SAP ≫ Erp (ea-finserv) Version 616
SAP ≫ Erp (ea-finserv) Version 617
SAP ≫ Erp (ea-finserv) Version 618
SAP ≫ Erp (ea-finserv) Version 800
SAP ≫ Erp (s4core) Version 101
SAP ≫ Erp (s4core) Version 102
SAP ≫ Erp (s4core) Version 103
SAP ≫ Erp (s4core) Version 104
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.473
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NIST 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
SAP 5.4 2.8 2.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775
Vendor Advisory
https://launchpad.support.sap.com/#/notes/2906996
Permissions Required