Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

CVE-2020-6297 Information Disclosure in SAP Data Intelligence, SAP security note 2940823

Description

During upgrade or installation, SAP Data Intelligence allows an attacker who has access to a specific Kubernetes cluster to read highly sensitive data such as system password. This would allow him to modify or delete data and impact the availability of this specific cluster. 

Available fix and Supported packages

  • DH_FOUNDATION | 3 | 3
  • DATAHUB 3.0 | SP001 | 000000

Affected component

    CA-DI-ONP
    SAP DI, on-premise: Please use CA-DI instead

CVSS

Score: 6.3
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2940823

TAGS

#Information-Exposure
#Information-Leak
#&160-CVE-2020-6297

More to explorer

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.