« Volver al listado

CVE-2020-6265

Estado: ModificadaCrítica (9.8)—

SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

SAP — CommerceSAP — Commerce Data HUB

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6265",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.7"
            },
            {
              "status": "affected",
              "version": "< 1808"
            },
            {
              "status": "affected",
              "version": "< 1811"
            },
            {
              "status": "affected",
              "version": "< 1905"
            }
          ]
        },
        {
          "vendor": "SAP SE",
          "product": "SAP Commerce (Data Hub)",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.7"
            },
            {
              "status": "affected",
              "version": "< 1808"
            },
            {
              "status": "affected",
              "version": "< 1811"
            },
            {
              "status": "affected",
              "version": "< 1905"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-09T19:15:10.543",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2918924",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2918924",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials."
    },
    {
      "lang": "es",
      "value": "SAP Commerce, versiones - 6.7, 1808, 1811, 1905, y SAP Commerce (Data Hub), versiones - 6.7, 1808, 1811, 1905, permite a un atacante omitir una autenticación y/o autorización configurada por el administrador del sistema debido al uso de Credenciales Embebidas"
    }
  ],
  "lastModified": "2026-06-17T03:22:58.290",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:commerce:6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20B6F0DE-3989-47FD-97F0-2F52245D57A1"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:1808:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F352D085-2B1E-44A9-81C6-2E1F5C249AB4"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:1811:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27A12336-30BA-439D-A3F2-B7D93D5B52DC"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F665F648-5C35-4EC8-8064-8ED139C8813C"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_data_hub:6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99ACEB84-0AEB-438D-93BB-4CE4CC5047DF"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_data_hub:1808:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7595660F-77F1-4512-B9C9-596F513E8DFC"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_data_hub:1811:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "623BF378-FA6E-4110-818A-B4E69F3071B7"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_data_hub:1905:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F7D9F96-93D8-42EE-83B4-0B2AB8800923"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}