Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

CVE-2020-6268 Missing authorization check in SAP ERP (Statutory Reporting for Insurance Companies), SAP security note 2906996

Description

Statutory Reporting for Insurance Companies does not execute the required authorization checks for an authenticated user, which may result in an escalation of privileges.

 The known effects of the missing authorization check include:

  • Fraudulent or incorrect use of functions the use of which should be restricted to certain user groups
  • Ability to read, modify or delete data, to which access should be restricted.

Available fix and Supported packages

  • S4CORE | 101 | 101
  • S4CORE | 102 | 102
  • S4CORE | 103 | 103
  • S4CORE | 104 | 104
  • EA-FINSERV | 600 | 600
  • EA-FINSERV | 603 | 603
  • EA-FINSERV | 604 | 604
  • EA-FINSERV | 605 | 605
  • EA-FINSERV | 606 | 606
  • EA-FINSERV | 616 | 616
  • EA-FINSERV | 617 | 617
  • EA-FINSERV | 618 | 618
  • EA-FINSERV | 800 | 800
  • S4CORE 101 | SAPK-10109INS4CORE |
  • S4CORE 102 | SAPK-10207INS4CORE |
  • S4CORE 103 | SAPK-10305INS4CORE |
  • S4CORE 104 | SAPK-10403INS4CORE |
  • EA-FINSERV 600 | SAPKGPFD34 |
  • EA-FINSERV 603 | SAPK-60323INEAFINSRV |
  • EA-FINSERV 604 | SAPK-60424INEAFINSRV |
  • EA-FINSERV 605 | SAPK-60521INEAFINSRV |
  • EA-FINSERV 606 | SAPK-60626INEAFINSRV |
  • EA-FINSERV 617 | SAPK-61721INEAFINSRV |
  • EA-FINSERV 618 | SAPK-61815INEAFINSRV |
  • EA-FINSERV 800 | SAPK-80011INEAFINSRV |

Affected component

    FS-SR
    Statutory Reporting for Insurancies

CVSS

Score: 5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2906996

TAGS

#Access-control
#authorization-error
#authorization-profile
#&x00A0-CVE-2020-6268

More to explorer

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.