4.3

CVE-2020-6316

SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Erp Version 600
SAP ≫ Erp Version 602
SAP ≫ Erp Version 603
SAP ≫ Erp Version 604
SAP ≫ Erp Version 605
SAP ≫ Erp Version 606
SAP ≫ Erp Version 616
SAP ≫ Erp Version 617
SAP ≫ Erp Version 618
SAP ≫ S/4HANA Version 100
SAP ≫ S/4HANA Version 101
SAP ≫ S/4HANA Version 102
SAP ≫ S/4HANA Version 103
SAP ≫ S/4HANA Version 104
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.82% 0.536
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
SAP 4.3 2.8 1.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
Vendor Advisory
https://launchpad.support.sap.com/#/notes/2944188
Permissions Required