Vulnerability · Published Apr 14, 2020 · Assigned by sap

CVE-2020-6214

Medium 4.7

In plain English

A medium-severity incorrect authorization in SAP S/4HANA (Financial Products Subledger) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.0)4.7Medium

Exploit odds (30 days)0.6%top 48.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected with other authorization objects, exploitation of the vulnerability would allow an authenticated attacker to view, change, or delete data, thereby preventing the proper segregation of duties in the system.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP S/4HANA (Financial Products Subledger)	< 100

Weakness: CWE-863 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References

https://launchpad.support.sap.com/#/notes/2897612 x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 x_refsource_MISC