What is CVE-2020-6268?

CVE-2020-6268 is a high-severity vulnerability in Sap Erp \(Ea-Finserv\), classified under Missing Authorization. CVSS score: 8.1/10. Published 2020-06-10.

How severe is CVE-2020-6268?

High severity. CVSS v3 base score is 8.1 out of 10.

Auth bypass in Sap Erp \(Ea-Finserv\)

CVE-2020-6268

Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.

Vulnerability class: Broken Access Control

EPSS: 0.007 (48.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Sap Erp_\(ea-finserv\) — versions 600, 603, 604
Sap Erp_\(s4core\) — versions 101, 102, 103
Sap Se Erp (Statutory Reporting For Insurance Companies) — versions < EA-FINSERV 600, < 603, < 604

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-6268?: CVE-2020-6268 is a high-severity vulnerability in Sap Erp \(Ea-Finserv\), classified under Missing Authorization. CVSS score: 8.1/10. Published 2020-06-10.
How severe is CVE-2020-6268?: High severity. CVSS v3 base score is 8.1 out of 10.