SAP security note 2908560, "[CVE-2020-6249] SQL Injection vulnerability in SAP Master Data Governance(MDG)", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The use of an admin backend report from within MDG allows an attacker to execute crafted database queries, exposing the backend database.
- Read sensitive data: Unauthorized users can access confidential information stored in the database.
- Execute admin-level operations: Attackers can perform high-privileged operations on the database, potentially compromising data integrity and availability.
Solution
To mitigate this vulnerability, implement the Support Packages and Patches referenced by this SAP Note. The report now screens user input for proper data submission and removes dangerous SQL statements. Ensure that all relevant support packages for your SAP components are up to date.
CVSS
Score 7.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Full note on SAP: SAP Support Launchpad note 2908560
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].