CVE-2020-6204

Published: Mar 10, 2020Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.

Affected (13)

Products: Sap: Treasury And Risk Management (ea Finserv), Treasury And Risk Management (s4core)

Sap

2 products

Treasury And Risk Management (ea Finserv)

Treasury And Risk Management (s4core)

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Sap Treasury And Risk Management (ea Finserv)	Version 600
Sap Treasury And Risk Management (ea Finserv)	Version 603
Sap Treasury And Risk Management (ea Finserv)	Version 604
Sap Treasury And Risk Management (ea Finserv)	Version 605
Sap Treasury And Risk Management (ea Finserv)	Version 606
Sap Treasury And Risk Management (ea Finserv)	Version 616
Sap Treasury And Risk Management (ea Finserv)	Version 617
Sap Treasury And Risk Management (ea Finserv)	Version 618
Sap Treasury And Risk Management (ea Finserv)	Version 800
Sap Treasury And Risk Management (s4core)	Version 101
Sap Treasury And Risk Management (s4core)	Version 102
Sap Treasury And Risk Management (s4core)	Version 103
Sap Treasury And Risk Management (s4core)	Version 104