Lucene search

SapCVE-2020-6264

HistoryJun 10, 2020 - 1:15 p.m.

CVE-2020-6264

2020-06-1013:15:18

sap

web.nvd.nist.gov

cve-2020-6264

sap commerce

unauthorized access

information disclosure

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

55.1%

JSON

SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leading to Information Disclosure.

Affected configurations

Nvd

Node

sapcommerceMatch6.7

sapcommerceMatch1808

sapcommerceMatch1811

sapcommerceMatch1905

VendorProductVersionCPE
sapcommerce6.7cpe:2.3:a:sap:commerce:6.7:*:*:*:*:*:*:*
sapcommerce1808cpe:2.3:a:sap:commerce:1808:*:*:*:*:*:*:*
sapcommerce1811cpe:2.3:a:sap:commerce:1811:*:*:*:*:*:*:*
sapcommerce1905cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	commerce	6.7	cpe:2.3:a:sap:commerce:6.7:::::::*
sap	commerce	1808	cpe:2.3:a:sap:commerce:1808:::::::*
sap	commerce	1811	cpe:2.3:a:sap:commerce:1811:::::::*
sap	commerce	1905	cpe:2.3:a:sap:commerce:1905:::::::*

CNA Affected

[
  {
    "product": "SAP Commerce",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 6.7"
      },
      {
        "status": "affected",
        "version": "< 1808"
      },
      {
        "status": "affected",
        "version": "< 1811"
      },
      {
        "status": "affected",
        "version": "< 1905"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2906366

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

55.1%

JSON

Related for CVE-2020-6264