CVE-2020-6311

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not correctly perform necessary authorization checks for an authenticated user due to Improper Authorization checks, that may cause a system administrator to create incorrect authorization proposals. This may result in privilege escalation and may expose restricted banking data.

Los Servicios Banking de SAP (Bank Analyzer), versión - 500, y SAP S/4HANA para el libro mayor de productos financieros, versión ? 100, no realiza correctamente las comprobaciones de autorización necesarias para un usuario autenticado debido a las comprobaciones de autorización inadecuadas, que pueden hacer que un administrador del sistema cree propuestas de autorización incorrectas. Esto puede resultar en una escalada de privilegios y puede exponer datos bancarios restringidos

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-01-08 CVE Reserved
2020-09-09 CVE Published
2023-05-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-285: Improper Authorization
CWE-863: Incorrect Authorization

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sap Search vendor "Sap"		Bank Analyzer Search vendor "Sap" for product "Bank Analyzer"				500 Search vendor "Sap" for product "Bank Analyzer" and version "500"		-		Affected
Sap Search vendor "Sap"		S\/4hana For Financial Products Subledger Search vendor "Sap" for product "S\/4hana For Financial Products Subledger"				100 Search vendor "Sap" for product "S\/4hana For Financial Products Subledger" and version "100"		-		Affected