PT-2020-19030 · Sap · Sap Commerce

Published 2020-04-14 · Updated 2020-04-15 · CVE-2020-6232

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Commerce versions 1811, 1905

Description The issue is related to missing authorization checks for anonymous users, which affects the confidentiality of secure media. This means that an unauthorized user may be able to access sensitive information without proper clearance.

Recommendations For SAP Commerce versions 1811 and 1905, consider implementing additional authorization checks to ensure that anonymous users cannot access secure media without proper clearance. As a temporary workaround, restrict access to secure media for anonymous users until a proper fix is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-6232

Affected Products

Sap Commerce

References · 5

• https://osv.dev/vulnerability/CVE-2020-6232 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2888556 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6232 · Security Note
• https://t.me/cvenotify/2732 · Telegram Post