Vulnerability · Published Sep 9, 2020 · Assigned by sap

CVE-2020-6311

Medium 6.5

In plain English

A medium-severity security flaw in BANKING SERVICES FROM SAP 9.0(Bank Analyzer) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.0)6.5Medium

Exploit odds (30 days)1.0%top 36.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not correctly perform necessary authorization checks for an authenticated user due to Improper Authorization checks, that may cause a system administrator to create incorrect authorization proposals. This may result in privilege escalation and may expose restricted banking data.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	BANKING SERVICES FROM SAP 9.0(Bank Analyzer)	< 500
SAP SE	S/4HANA FIN PROD SUBLDGR	< 100

Weakness: CWE-285 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2951325 x_refsource_MISC