« Volver al listado

CVE-2020-6204

Estado: ModificadaMedia (4.3)—

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

SAP — Treasury AND Risk Management (ea-finserv)SAP — Treasury AND Risk Management (s4core)

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6204",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV)",
          "versions": [
            {
              "status": "affected",
              "version": "< 600"
            },
            {
              "status": "affected",
              "version": "< 603"
            },
            {
              "status": "affected",
              "version": "< 604"
            },
            {
              "status": "affected",
              "version": "< 605"
            },
            {
              "status": "affected",
              "version": "< 606"
            },
            {
              "status": "affected",
              "version": "< 616"
            },
            {
              "status": "affected",
              "version": "< 617"
            },
            {
              "status": "affected",
              "version": "< 618"
            },
            {
              "status": "affected",
              "version": "< 800"
            }
          ]
        },
        {
          "vendor": "SAP SE",
          "product": "SAP Treasury and Risk Management (Transaction Management) (S4CORE)",
          "versions": [
            {
              "status": "affected",
              "version": "< 101"
            },
            {
              "status": "affected",
              "version": "< 102"
            },
            {
              "status": "affected",
              "version": "< 103"
            },
            {
              "status": "affected",
              "version": "< 104"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-03-10T21:15:14.527",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2841874",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2841874",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check."
    },
    {
      "lang": "es",
      "value": "La consulta de selección en SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV versiones 600, 603, 604, 605, 606, 616, 617, 618, 800 y S4CORE versiones 101, 102, 103, 104), devuelve más registros de los que deberían ser cuando selecciona y despliega el número de contrato, conllevando a una Falta de Comprobación de Autorización."
    }
  ],
  "lastModified": "2026-06-17T03:22:51.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):600:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EFF8EC8-0C4E-4D93-AECF-6711B470FB54"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):603:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F10EBDE7-0EEE-42E1-A860-ECE0B606D385"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):604:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39437BF7-3C69-43E3-8EFA-EAED49704543"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):605:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "447929D0-5FF0-44EC-99B4-A0A6F3D098AB"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):606:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5085EED2-349E-42D2-A5AE-0F307D43C774"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):616:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4495C9D-8489-4FC1-94F6-84D203F9B388"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):617:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66AC9F3C-5CE8-4036-9970-5BF9A09C3E06"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):618:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA62E740-4F8D-4E34-8FFE-AA341963308F"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):800:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "349C577E-7966-41CE-A116-4CF9EE47D3D3"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):101:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E21EE73-34F2-4D1C-8C6F-0B0489C049F1"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):102:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B1E8180-D2BB-423C-84BC-CA738F61C518"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):103:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "215CC44C-D4EA-4CAF-946B-5109790F6636"
            },
            {
              "criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):104:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A389AB7-2487-4AEA-BDA3-3E8CC7BB163F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}