What is CVE-2020-6212?

CVE-2020-6212 is a medium-severity vulnerability in SAP Erp, classified under Missing Authorization. CVSS score: 5.4/10. Published 2020-04-24.

How severe is CVE-2020-6212?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Auth bypass in SAP Erp

CVE-2020-6212

Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user, allowing reading or modification of some tax reports, due to Missing Authorization Check.

Vulnerability class: Broken Access Control

EPSS: 0.007 (47.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Sap Erp — versions 607, 618, 730
Sap S\/4hana — versions 100, 101, 102
Sap Se Erp — versions < 618, < 730, < EAPPLGLO 607
Sap Se S/4 Hana — versions < 100, < 101, < 102

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-6212?: CVE-2020-6212 is a medium-severity vulnerability in SAP Erp, classified under Missing Authorization. CVSS score: 5.4/10. Published 2020-04-24.
How severe is CVE-2020-6212?: Medium severity. CVSS v3 base score is 5.4 out of 10.