PT-2020-19011 · Sap · Sap Erp+1

Published 2020-04-24 · Updated 2020-05-08 · CVE-2020-6212

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP ERP versions 607 through 730 S/4 HANA versions 100 through 104

Description The issue concerns the Egypt localized withholding tax reports in SAP systems, where the Clearing of Liabilities and Remittance Statement and Summary do not perform necessary authorization checks for an authenticated user. This allows the reading or modification of some tax reports due to a missing authorization check.

Recommendations For SAP ERP versions 607 through 730, update to a version that includes the necessary authorization checks. For S/4 HANA versions 100 through 104, update to a version that includes the necessary authorization checks. As a temporary workaround, consider restricting access to the tax reports until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-6212

Affected Products

S/4Hana

Sap Erp

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6212 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2864966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6212 · Security Note
• https://t.me/cvenotify/3215 · Telegram Post