PT-2020-5976 · Sap · Sap Banking Services

Published 2020-08-11 · Updated 2020-08-14 · CVE-2020-6298

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions SAP Banking Services versions 400 through 500

Description The issue is related to a missing authorization check in the Generic Market Data component, allowing an unauthorized user to access and modify protected Business Partner Generic Market Data and related key figure values. This could potentially lead to the disclosure and integrity compromise of sensitive information.

Recommendations For versions 400 through 500, apply the necessary patches or updates to include authorization checks for Generic Market Data access and modifications. As a temporary workaround, consider restricting access to the Generic Market Data component until a patch is available. Restrict access to sensitive Business Partner data to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2021-02168

CVE-2020-6298

Affected Products

Sap Banking Services

References · 5

• https://osv.dev/vulnerability/CVE-2020-6298 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02168 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-6298 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2939685 · Note