PT-2020-19045 · Sap · Sap Master Data Governance

Published 2020-05-12 · Updated 2020-05-15 · CVE-2020-6249

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Master Data Governance versions S4CORE 101, S4FND 102, 103, 104, SAP BS FND 748

Description The issue allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection. This occurs through the use of an admin backend report within SAP Master Data Governance.

Recommendations For versions S4CORE 101, S4FND 102, 103, 104, SAP BS FND 748, consider restricting access to the admin backend report to minimize the risk of exploitation. As a temporary workaround, avoid using the admin backend report until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-6249

Affected Products

Sap Master Data Governance

References · 5

• https://osv.dev/vulnerability/CVE-2020-6249 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6249 · Security Note
• https://t.me/cvenotify/3719 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2908560 · Note