« Volver al listado

CVE-2020-6298

Estado: ModificadaAlta (8.1)—

SAP Banking Services (Generic Market Data), versiones - 400, 450, 500, permite a un usuario no autorizado mostrar el Generic Market Data (GMD) protegido del Business Partner y cambiar los valores de cifras claves de GMD relacionadas, debido a una Falta de Comprobación de Autorización

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Generic Market Data

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6298",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Banking Services (Generic Market Data)",
          "versions": [
            {
              "status": "affected",
              "version": "< 400"
            },
            {
              "status": "affected",
              "version": "< 450"
            },
            {
              "status": "affected",
              "version": "< 500"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-08-12T14:15:14.347",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2939685",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2939685",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Generic Market Data (GMD) and change related GMD key figure values, due to Missing Authorization Check."
    },
    {
      "lang": "es",
      "value": "SAP Banking Services (Generic Market Data), versiones - 400, 450, 500, permite a un usuario no autorizado mostrar el Generic Market Data (GMD) protegido del Business Partner y cambiar los valores de cifras claves de GMD relacionadas, debido a una Falta de Comprobación de Autorización"
    }
  ],
  "lastModified": "2026-06-17T03:23:01.503",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:generic_market_data:400:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFECB25E-D304-4282-AAE6-3F3BA43FCA33"
            },
            {
              "criteria": "cpe:2.3:a:sap:generic_market_data:450:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAB89C9B-7A2B-4AC6-B017-2BDB9D2E3C70"
            },
            {
              "criteria": "cpe:2.3:a:sap:generic_market_data:500:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E18C7ADF-846C-47CD-8EF7-83EB64BA335B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}