CVE-2020-6199
5.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
5.4 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
22.8%
The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization Check.
Affected configurations
CNA Affected
[
{
"product": "SAP ERP (EAPPGLO)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "< 607"
}
]
},
{
"product": "SAP ERP (SAP_FIN)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "< 618"
},
{
"status": "affected",
"version": "< 730"
}
]
},
{
"product": "SAP S/4HANA (S4CORE)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "< 100"
},
{
"status": "affected",
"version": "< 101"
},
{
"status": "affected",
"version": "< 102"
},
{
"status": "affected",
"version": "< 103"
},
{
"status": "affected",
"version": "< 104"
}
]
}
]Related
5.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
5.4 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
22.8%