PT-2020-19000 · Sap · Sap S/4Hana+2

Published 2020-03-10 · Updated 2020-03-12 · CVE-2020-6199

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP ERP (MENA Certificate Management) EAPPGLO version 607 SAP FIN versions 618, 730 SAP S/4HANA (MENA Certificate Management) S4CORE versions 100, 101, 102, 103, 104

Description The view FIMENAV COMPCERT does not have any authorization check, allowing an attacker without an authorization group to maintain any company certificate. This leads to a missing authorization check, potentially enabling unauthorized access and modifications to company certificates.

Recommendations For SAP ERP (MENA Certificate Management) EAPPGLO version 607, consider implementing an authorization check for the FIMENAV COMPCERT view to restrict access. For SAP FIN versions 618, 730, implement an authorization check for the FIMENAV COMPCERT view to prevent unauthorized maintenance of company certificates. For SAP S/4HANA (MENA Certificate Management) S4CORE versions 100, 101, 102, 103, 104, restrict access to the FIMENAV COMPCERT view until an authorization check is implemented.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-6199

Affected Products

Sap Erp

Sap S/4Hana

Sap Fin

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6199 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6199 · Vendor Advisory
• https://t.me/cvenotify/1504 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2871167 · Note