Vulnerability Name:

CVE-2020-6188 (CCN-176218)

Assigned:2020-02-11
Published:2020-02-11
Updated:2020-02-19
Summary:VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
6.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N)
5.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-862
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2020-6188

Source: XF
Type: UNKNOWN
sap-cve20206188-sec-bypass(176218)

Source: CCN
Type: SAP Web site
SAP Support Note 2857511

Source: MISC
Type: Permissions Required, Vendor Advisory
https://launchpad.support.sap.com/#/notes/2857511

Source: CCN
Type: SAP Security Patch Day - February 2020
SAP Security Patch Day - February 2020

Source: MISC
Type: Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812

Vulnerable Configuration:Configuration 1:
  • cpe:/a:sap:erp:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:sap:s/4_hana:1511:*:*:*:*:*:*:*
  • OR cpe:/a:sap:s/4_hana:1610:*:*:*:*:*:*:*
  • OR cpe:/a:sap:s/4_hana:1709:*:*:*:*:*:*:*
  • OR cpe:/a:sap:s/4_hana:1809:*:*:*:*:*:*:*
  • OR cpe:/a:sap:s/4_hana:1909:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    sap erp 6.0
    sap s/4 hana 1511
    sap s/4 hana 1610
    sap s/4 hana 1709
    sap s/4 hana 1809
    sap s/4 hana 1909