SAP SE SAP Disclosure Management
13 CVEs affecting SAP SE SAP Disclosure Management. Latest disclosed: 2020-07-14. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-6292 | High | 8.8 | 2020-07-14 | Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration. |
CVE-2020-6291 | High | 8.8 | 2020-07-14 | SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leadi… |
CVE-2020-6289 | High | 8.8 | 2020-07-14 | SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malic… |
CVE-2019-0258 | High | 8.8 | 2019-02-15 | SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2020-6209 | High | 7.5 | 2020-03-10 | SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts… |
CVE-2020-6290 | Medium | 6.3 | 2020-07-14 | SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID. |
CVE-2020-6267 | Medium | 5.4 | 2020-07-14 | Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag. |
CVE-2020-6303 | Medium | 5.4 | 2020-01-14 | SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. |
CVE-2019-0254 | Medium | 5.4 | 2019-02-15 | SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnera… |
CVE-2018-2413 | Medium | 5.4 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2018-2403 | Medium | 5.4 | 2018-04-10 | Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an au… |
CVE-2018-2404 | Medium | 4.3 | 2018-04-10 | SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. |
CVE-2018-2412 | Low | 3.8 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |