Skip links
RedRays
Published in: sap note

CVE-2020-6270 Missing Authorization check in SAP Netweaver AS ABAP (Banking Services), SAP security note 2916562

Author
Published on:

Description

Banking Services does not perform necessary authorization checks for an authenticated user, allowing wrong and unexpected change of individual conditions by a malicious user leading to wrong prices.

Some well-known impacts of Missing Authorization check are –

  • abuse functionality restricted to a particular user group
  • modify or delete restricted data    

Available fix and Supported packages

  • SAP_ABA | 710 | 711
  • SAP_ABA | 740 | 740
  • SAP_ABA | 750 | 752
  • SAP_ABA | 75A | 75E
  • | SAPK-781BHINSAPBASIS |
  • SAP_ABA 711 | SAPKA71120 |
  • SAP_ABA 740 | SAPKA74024 |
  • SAP_ABA 751 | SAPK-75111INSAPABA |
  • SAP_ABA 75B | SAPK-75B11INSAPABA |
  • SAP_ABA 752 | SAPK-75207INSAPABA |
  • SAP_ABA 75C | SAPK-75C07INSAPABA |
  • SAP_ABA 75D | SAPK-75D05INSAPABA |
  • SAP_ABA 75E | SAPK-75E03INSAPABA |
  • SAP_ABA 750 | SAPK-75019INSAPABA |
  • SAP_ABA 75A | SAPK-75A19INSAPABA |

Affected component

    FS-AM-PR-CD
    Financial Conditions

CVSS

Score: 6.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2916562

TAGS

#Access-control
#Authorization-error
#Authorization-profile
#&160-CVE-2020-6270&160

You may also like