8.1

CVE-2020-6301

SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settle trips, resulting in escalation of privileges, due to Missing Authorization Check.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Hcm Travel Management Version 600
SAP ≫ Hcm Travel Management Version 602
SAP ≫ Hcm Travel Management Version 603
SAP ≫ Hcm Travel Management Version 604
SAP ≫ Hcm Travel Management Version 605
SAP ≫ Hcm Travel Management Version 606
SAP ≫ Hcm Travel Management Version 607
SAP ≫ Hcm Travel Management Version 608
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.71% 0.486
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NIST 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
SAP 5.4 2.8 2.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345
Vendor Advisory
https://launchpad.support.sap.com/#/notes/2949196
Permissions Required