What is CVE-2020-6204?

CVE-2020-6204 is a medium-severity vulnerability in Sap Treasury And Risk Management \(Ea-Finserv\), classified under Missing Authorization. CVSS score: 4.3/10. Published 2020-03-10.

How severe is CVE-2020-6204?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Sap Treasury And Risk Management \(Ea-Finserv\)

CVE-2020-6204

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.

Vulnerability class: Broken Access Control

EPSS: 0.006 (46.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Sap Treasury_and_risk_management_\(ea-finserv\) — versions 600, 603, 604
Sap Treasury_and_risk_management_\(s4core\) — versions 101, 102, 103
Sap Se Treasury And Risk Management (Transaction Management) (Ea-finserv) — versions < 600, < 603, < 604
Sap Se Treasury And Risk Management (Transaction Management) (S4core) — versions < 101, < 102, < 103

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-6204?: CVE-2020-6204 is a medium-severity vulnerability in Sap Treasury And Risk Management \(Ea-Finserv\), classified under Missing Authorization. CVSS score: 4.3/10. Published 2020-03-10.
How severe is CVE-2020-6204?: Medium severity. CVSS v3 base score is 4.3 out of 10.