CVE-2020-6362

SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn could lead to Service interruptions and system unavailability for the victim and users of the component.

CVSS v3 6.5 MEDIUM
CVSS v2.0 6.8 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:C

Exploitability : 8.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://launchpad.support.sap.com/#/notes/2953212	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196	Vendor Advisory
https://launchpad.support.sap.com/#/notes/2953212	Permissions Required Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:banking_services:500:*:*:*:*:*:*:*

History

21 Nov 2024, 05:35

Type	Values Removed	Values Added
References	~~() https://launchpad.support.sap.com/#/notes/2953212 - Permissions Required, Vendor Advisory~~	() https://launchpad.support.sap.com/#/notes/2953212 - Permissions Required, Vendor Advisory
References	~~() https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 - Vendor Advisory~~	() https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 - Vendor Advisory

Information

Published : 2020-10-20 14:15

Updated : 2024-11-21 05:35

NVD link : CVE-2020-6362

Mitre link : CVE-2020-6362

CVE.ORG link : CVE-2020-6362

JSON object : View

Products Affected

sap

banking_services

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2020-6362", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-10-20T14:15:14.413", "references": [{"url": "https://launchpad.support.sap.com/#/notes/2953212", "tags": ["Permissions Required", "Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://launchpad.support.sap.com/#/notes/2953212", "tags": ["Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn could lead to Service interruptions and system unavailability for the victim and users of the component."}, {"lang": "es", "value": "SAP Banking Services versi\u00f3n 500, usa un objeto de autorizaci\u00f3n incorrecto en algunos de sus reportes. Aunque los reportes afectados est\u00e1n protegidos con otros objetos de autorizaci\u00f3n, la explotaci\u00f3n de la vulnerabilidad podr\u00eda conducir a una escalada de privilegios y una violaci\u00f3n en la segregaci\u00f3n de funciones, lo que a su vez podr\u00eda conllevar a interrupciones del servicio y una falta de disponibilidad del sistema para la v\u00edctima y los usuarios del componente"}], "lastModified": "2024-11-21T05:35:34.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:banking_services:500:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "454A0980-DF72-4083-B42D-DFD7BDE7A5CD"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}