PT-2020-19040 · Sap · Sap Business Client

Published 2020-05-12 · Updated 2025-05-27 · CVE-2020-6244

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Business Client version 7.0

Description The issue allows an attacker, after a successful social engineering attack, to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to an uncontrolled search path element. This could enable the attacker to control the behavior of the application.

Recommendations For SAP Business Client version 7.0, consider restricting the execution of DLL files from untrusted directories to minimize the risk of exploitation. As a temporary workaround, ensure that all directories where the application searches for DLLs are trusted and properly secured. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-6244

Affected Products

Sap Business Client

References · 6

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6244 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6244 · Vendor Advisory
• https://t.me/cvenotify/123724 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2911801 · Note
• https://t.me/cvenotify/3715 · Telegram Post