PT-2020-18991 · Sap · Sap Fin+2

Published 2020-02-12 · Updated 2020-02-19 · CVE-2020-6188

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP APPL versions 600 through 606, 616 SAP FIN versions 617 through 618, 700, 720, 730 SAP S/4 HANA versions 100 through 104

Description The issue is related to Missing Authorization Check in VAT Pro-Rata reports. This occurs because the reports do not perform necessary authorization checks for an authenticated user.

Recommendations For SAP APPL versions 600 through 606, 616, update to a version that includes the necessary authorization checks. For SAP FIN versions 617 through 618, 700, 720, 730, update to a version that includes the necessary authorization checks. For SAP S/4 HANA versions 100 through 104, update to a version that includes the necessary authorization checks.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-6188

Affected Products

Sap S/4Hana

Sap Appl

Sap Fin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-6188 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6188 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2857511 · Vendor Advisory
• https://t.me/cvenotify/960 · Telegram Post