PT-2020-19062 · Sap · Sap Disclosure Management

Published 2020-07-14 · Updated 2022-10-12 · CVE-2020-6267

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP Disclosure Management version 10.1

Description The issue concerns sensitive cookies missing the HttpOnly flag in SAP Disclosure Management, which can lead to sensitive cookies being accessed without the HttpOnly flag. This affects the security of the cookies.

Recommendations For SAP Disclosure Management version 10.1, consider configuring the cookies to include the HttpOnly flag to mitigate the risk of sensitive cookie exposure. As a temporary workaround, restrict access to sensitive cookies until a proper fix is applied.

Fix

Incorrect Permission

Weakness Enumeration

CWE-1004

CWE-732

Related Identifiers

CVE-2020-6267

Affected Products

Sap Disclosure Management

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6267 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6267 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2758000 · Vendor Advisory
• https://t.me/cvenotify/4997 · Telegram Post