Skip links

CVE-2020-6273 Missing Authorization check in SAP S/4 HANA (Fiori UI for General Ledger Accounting), SAP security note 2885671

Description

In SAP S/4 HANA’s Fiori UI for General Ledger Accounting, an attacker with a non-administrative user account can identify and remove certain attachments belonging to another user without authorization. Removing the attachment does not depend on any action to be taken by the owning user. The attacker cannot view or alter the contents of the attachment, they can only remove it making it unavailable to its owner.

Available fix and Supported packages

  • S4CORE | 103 | 103
  • S4CORE | 104 | 104
  • | SAPK-S4CLOUD_2008 |
  • S4CORE 103 | SAPK-10305INS4CORE |
  • S4CORE 104 | SAPK-10403INS4CORE |

Affected component

    FI-FIO-GL
    Fiori UI for General Ledger Accounting

CVSS

Score: 4.3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2885671

TAGS

#Access-control
#Authorization-error
#Authorization-profile
#&160-CVE-2020-6273