CVE-2020-6249

HIGH

8.8

Beschreibung

The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht5/12/2020

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

sap:master_data_governance_\(s4core\)sap:master_data_governance_\(s4fnd\)sap:master_data_governance_\(sap_bs_fnd\)

Schwachen (CWE)

CWE-89

Referenzen

https://launchpad.support.sap.com/#/notes/2908560(cna@sap.com)

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222(cna@sap.com)

https://launchpad.support.sap.com/#/notes/2908560(af854a3a-2127-422b-91ae-364da2661108)

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.