CVE-2020-6270

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-6270
SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user leading to wrong prices.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://launchpad.support.sap.com/#/notes/2916562 Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:netweaver_application_server_abap:75a:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:75b:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:75c:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:75d:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:75e:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:*
History

05 Oct 2022, 14:16

Type Values Removed Values Added
First Time Sap netweaver Application Server Abap
CPE cpe:2.3:a:sap:netweaver_as_abap:75a:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:75e:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:75c:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:711:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:752:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:75b:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:75d:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap:751:*:*:*:*:*:*:*		 cpe:2.3:a:sap:netweaver_application_server_abap:75c:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:75e:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:75a:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:75b:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:75d:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:*
Information

Published : 2020-06-10 13:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-6270

Mitre link : CVE-2020-6270

CVE.ORG link : CVE-2020-6270

JSON object : View

Products Affected

sap

  • netweaver_application_server_abap
CWE
CWE-862

Missing Authorization