Auth bypass in SAP Banking Services
CVE-2020-6362
SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn could lead to Service interruptions and system unavailability for the victim and users of the component.
Vulnerability class: Broken Access Control
EPSS: 0.010 (60.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Sap Banking_services — versions 500
- Sap Se Banking Services — versions < 500
Weakness classification (CWE)
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-6362?
- CVE-2020-6362 is a medium-severity vulnerability in SAP Banking Services, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2020-10-20.
- How severe is CVE-2020-6362?
- Medium severity. CVSS v3 base score is 6.5 out of 10.