PT-2020-1566 · Sap · Sap Basis

Published 2020-01-14 · Updated 2021-07-21 · CVE-2020-6307

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Basis versions 7.0 through 7.54

Description The issue is related to the Automated Note Search Tool component of the SAP Basis platform, which lacks protection for internal data. This can allow a remote attacker to gain unauthorized access to protected information. The problem arises because the Automated Note Search Tool does not perform sufficient authorization checks, leading to the potential reading of sensitive information.

Recommendations For SAP Basis versions 7.0 through 7.54, update to a version that includes the provided update for the Automated Note Search Tool to ensure sufficient authorization checks are in place.

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

BDU:2020-00568

CVE-2020-6307

Affected Products

Sap Basis

References · 5

• https://bdu.fstec.ru/vul/2020-00568 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6307 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2863397 · Note