« Volver al listado

CVE-2020-6212

Estado: ModificadaMedia (5.4)—

Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user, allowing reading or modification of some tax reports, due to Missing Authorization Check.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

SAP — ERPSAP — S/4hana

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6212",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP ERP",
          "versions": [
            {
              "status": "affected",
              "version": "< 618"
            },
            {
              "status": "affected",
              "version": "< 730"
            },
            {
              "status": "affected",
              "version": "< EAPPLGLO 607"
            }
          ]
        },
        {
          "vendor": "SAP SE",
          "product": "SAP S/4 HANA",
          "versions": [
            {
              "status": "affected",
              "version": "< 100"
            },
            {
              "status": "affected",
              "version": "< 101"
            },
            {
              "status": "affected",
              "version": "< 102"
            },
            {
              "status": "affected",
              "version": "< 103"
            },
            {
              "status": "affected",
              "version": "< 104"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-24T23:15:11.670",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2864966",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2864966",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user, allowing reading or modification of some tax reports, due to Missing Authorization Check."
    },
    {
      "lang": "es",
      "value": "Los reportes Clearing of Liabilities and Remittance Statement and Summary de retención de impuestos ubicados en Egypt en SAP ERP (versiones 618, 730, EAPPLGLO 607) y S / 4 HANA (versiones 100, 101, 102, 103, 104) no realizan las comprobaciones de autorización necesarias para un usuario autenticado, lo que permite la lectura o modificación de algunos reportes fiscales, debido a la Falta de Comprobación de Autorización."
    }
  ],
  "lastModified": "2026-06-17T03:22:52.693",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:erp:607:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56B0EE10-D5C3-4BA8-A2D5-3BE53F890F0C"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4573BD22-D50B-431E-928A-C495E342D1AE"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp:730:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EBA7545-3DC3-45A7-8DF4-35F863C3B985"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:100:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11051D6A-FC81-4951-ACDA-BB07D5A5D751"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:101:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6FE144C-BAF2-4E45-93EE-D70764BDEFD6"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:102:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55BACB30-A607-410E-AB05-E991CC19CE12"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:103:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95A0C742-4CBD-46B8-B2B3-5949EFC82A6D"
            },
            {
              "criteria": "cpe:2.3:a:sap:s\\/4hana:104:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14A540DA-F234-4EEA-ADE8-4F6306A86C1E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}