PT-2020-5153 · Sap · Sap Erp

Published 2020-08-12 · Updated 2020-08-13 · CVE-2020-6301

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP ERP (HCM Travel Management) versions 600 through 608

Description The issue is related to a missing authorization check, allowing an authenticated but unauthorized attacker to read, modify, and settle trips. This can result in an escalation of privileges. The vulnerability is associated with the SAP ERP HCM component and can be exploited by a remote attacker to elevate their privileges.

Recommendations For SAP ERP (HCM Travel Management) versions 600 through 608, consider implementing additional authorization checks to restrict access to sensitive functions, such as trip management, until a formal fix is available. As a temporary workaround, restrict access to the travel management module to minimize the risk of exploitation.

Fix

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

BDU:2020-05760

BDU:2020-05778

CVE-2020-6301

Affected Products

Sap Erp

References · 6

• https://osv.dev/vulnerability/CVE-2020-6301 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05778 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-6301 · Security Note
• https://bdu.fstec.ru/vul/2020-05760 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2949196 · Note