CVE-2020-6316 - Vulnerability Details

Vendors	Products
Sap	Erp S\/4hana

Link	Providers
https://launchpad.support.sap.com/#/notes/2944188
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "SAP ERP", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 600"}, {"status": "affected", "version": "< 602"}, {"status": "affected", "version": "< 603"}, {"status": "affected", "version": "< 604"}, {"status": "affected", "version": "< 605"}, {"status": "affected", "version": "< 606"}, {"status": "affected", "version": "< 616"}, {"status": "affected", "version": "< 617"}, {"status": "affected", "version": "< 618"}]}, {"product": "SAP S/4 HANA", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 100"}, {"status": "affected", "version": "< 101"}, {"status": "affected", "version": "< 102"}, {"status": "affected", "version": "< 103"}, {"status": "affected", "version": "< 104"}]}], "descriptions": [{"lang": "en", "value": "SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Missing Authorization Check", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-11-10T16:11:29", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/2944188"}, {"tags": ["x_refsource_MISC"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2020-6316", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP ERP", "version": {"version_data": [{"version_name": "<", "version_value": "600"}, {"version_name": "<", "version_value": "602"}, {"version_name": "<", "version_value": "603"}, {"version_name": "<", "version_value": "604"}, {"version_name": "<", "version_value": "605"}, {"version_name": "<", "version_value": "606"}, {"version_name": "<", "version_value": "616"}, {"version_name": "<", "version_value": "617"}, {"version_name": "<", "version_value": "618"}]}}, {"product_name": "SAP S/4 HANA", "version": {"version_data": [{"version_name": "<", "version_value": "100"}, {"version_name": "<", "version_value": "101"}, {"version_name": "<", "version_value": "102"}, {"version_name": "<", "version_value": "103"}, {"version_name": "<", "version_value": "104"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check."}]}, "impact": {"cvss": {"baseScore": "4.3", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Missing Authorization Check"}]}]}, "references": {"reference_data": [{"name": "https://launchpad.support.sap.com/#/notes/2944188", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/2944188"}, {"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T08:55:22.258Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://launchpad.support.sap.com/#/notes/2944188"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"}]}]}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2020-6316", "datePublished": "2020-11-10T16:11:29", "dateReserved": "2020-01-08T00:00:00", "dateUpdated": "2024-08-04T08:55:22.258Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : SAP ERP (string)

vendor : SAP SE (string)

versions : [ »

0 : { »

status : affected (string)

version : < 600 (string)

}

1 : { »

status : affected (string)

version : < 602 (string)

}

2 : { »

status : affected (string)

version : < 603 (string)

}

3 : { »

status : affected (string)

version : < 604 (string)

}

4 : { »

status : affected (string)

version : < 605 (string)

}

5 : { »

status : affected (string)

version : < 606 (string)

}

6 : { »

status : affected (string)

version : < 616 (string)

}

7 : { »

status : affected (string)

version : < 617 (string)

}

8 : { »

status : affected (string)

version : < 618 (string)

}

]

}

1 : { »

product : SAP S/4 HANA (string)

vendor : SAP SE (string)

versions : [ »

0 : { »

status : affected (string)

version : < 100 (string)

}

1 : { »

status : affected (string)

version : < 101 (string)

}

2 : { »

status : affected (string)

version : < 102 (string)

}

3 : { »

status : affected (string)

version : < 103 (string)

}

4 : { »

status : affected (string)

version : < 104 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check. (string)

}

]

metrics : [ »

0 : { »

cvssV3_0 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.0 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Missing Authorization Check (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2020-11-10T16:11:29 (string)

orgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

shortName : sap (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://launchpad.support.sap.com/#/notes/2944188 (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cna@sap.com (string)

ID : CVE-2020-6316 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : SAP ERP (string)

version : { »

version_data : [ »

0 : { »

version_name : < (string)

version_value : 600 (string)

}

1 : { »

version_name : < (string)

version_value : 602 (string)

}

2 : { »

version_name : < (string)

version_value : 603 (string)

}

3 : { »

version_name : < (string)

version_value : 604 (string)

}

4 : { »

version_name : < (string)

version_value : 605 (string)

}

5 : { »

version_name : < (string)

version_value : 606 (string)

}

6 : { »

version_name : < (string)

version_value : 616 (string)

}

7 : { »

version_name : < (string)

version_value : 617 (string)

}

8 : { »

version_name : < (string)

version_value : 618 (string)

}

]

}

1 : { »

product_name : SAP S/4 HANA (string)

version : { »

version_data : [ »

0 : { »

version_name : < (string)

version_value : 100 (string)

}

1 : { »

version_name : < (string)

version_value : 101 (string)

}

2 : { »

version_name : < (string)

version_value : 102 (string)

}

3 : { »

version_name : < (string)

version_value : 103 (string)

}

4 : { »

version_name : < (string)

version_value : 104 (string)

}

]

}

]

}

vendor_name : SAP SE (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check. (string)

}

]

}

impact : { »

cvss : { »

baseScore : 4.3 (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.0 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Missing Authorization Check (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://launchpad.support.sap.com/#/notes/2944188 (string)

refsource : MISC (string)

url : https://launchpad.support.sap.com/#/notes/2944188 (string)

}

1 : { »

name : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 (string)

refsource : MISC (string)

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T08:55:22.258Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://launchpad.support.sap.com/#/notes/2944188 (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

assignerShortName : sap (string)

cveId : CVE-2020-6316 (string)

datePublished : 2020-11-10T16:11:29 (string)

dateReserved : 2020-01-08T00:00:00 (string)

dateUpdated : 2024-08-04T08:55:22.258Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:erp:600:*:*:*:*:*:*:*", "matchCriteriaId": "9E53BFD1-8B0D-4BAD-ABA8-24C4FB25036F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp:602:*:*:*:*:*:*:*", "matchCriteriaId": "973DF1B4-A0F9-4D7C-9367-BA3380F9E426", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp:603:*:*:*:*:*:*:*", "matchCriteriaId": "E560E999-5E5E-4EC2-87A7-DF52F3E1BD3D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp:604:*:*:*:*:*:*:*", "matchCriteriaId": "E9E38906-8B63-4E06-8BF3-EDC5BFF0BAF9", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp:605:*:*:*:*:*:*:*", "matchCriteriaId": "7C4FD4F9-A427-44EC-A266-B7BD9C4C7D63", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp:606:*:*:*:*:*:*:*", "matchCriteriaId": "0107AAA9-C29D-4447-847A-B1825C947D8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp:616:*:*:*:*:*:*:*", "matchCriteriaId": "6327AA0C-A8EF-47BC-BD27-B7835EC26AC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp:617:*:*:*:*:*:*:*", "matchCriteriaId": "619506AC-B6AB-4C7B-9A70-3B1753E2C441", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*", "matchCriteriaId": "4573BD22-D50B-431E-928A-C495E342D1AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:100:*:*:*:*:*:*:*", "matchCriteriaId": "11051D6A-FC81-4951-ACDA-BB07D5A5D751", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:101:*:*:*:*:*:*:*", "matchCriteriaId": "E6FE144C-BAF2-4E45-93EE-D70764BDEFD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:102:*:*:*:*:*:*:*", "matchCriteriaId": "55BACB30-A607-410E-AB05-E991CC19CE12", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:103:*:*:*:*:*:*:*", "matchCriteriaId": "95A0C742-4CBD-46B8-B2B3-5949EFC82A6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:104:*:*:*:*:*:*:*", "matchCriteriaId": "14A540DA-F234-4EEA-ADE8-4F6306A86C1E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check."}, {"lang": "es", "value": "SAP ERP y SAP S/4 HANA, permiten a un usuario autenticado visualizar los registros de costos de objetos para los que no cuenta con autorizaci\u00f3n en los reportes de PS, conllevando a una Falta de Comprobaci\u00f3n de Autorizaci\u00f3n"}], "id": "CVE-2020-6316", "lastModified": "2024-11-21T05:35:29.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-10T17:15:15.233", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://launchpad.support.sap.com/#/notes/2944188"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://launchpad.support.sap.com/#/notes/2944188"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:sap:erp:600:*:*:*:*:*:*:* (string)

matchCriteriaId : 9E53BFD1-8B0D-4BAD-ABA8-24C4FB25036F (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:sap:erp:602:*:*:*:*:*:*:* (string)

matchCriteriaId : 973DF1B4-A0F9-4D7C-9367-BA3380F9E426 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:sap:erp:603:*:*:*:*:*:*:* (string)

matchCriteriaId : E560E999-5E5E-4EC2-87A7-DF52F3E1BD3D (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:sap:erp:604:*:*:*:*:*:*:* (string)

matchCriteriaId : E9E38906-8B63-4E06-8BF3-EDC5BFF0BAF9 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:sap:erp:605:*:*:*:*:*:*:* (string)

matchCriteriaId : 7C4FD4F9-A427-44EC-A266-B7BD9C4C7D63 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:sap:erp:606:*:*:*:*:*:*:* (string)

matchCriteriaId : 0107AAA9-C29D-4447-847A-B1825C947D8B (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:sap:erp:616:*:*:*:*:*:*:* (string)

matchCriteriaId : 6327AA0C-A8EF-47BC-BD27-B7835EC26AC5 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:sap:erp:617:*:*:*:*:*:*:* (string)

matchCriteriaId : 619506AC-B6AB-4C7B-9A70-3B1753E2C441 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:* (string)

matchCriteriaId : 4573BD22-D50B-431E-928A-C495E342D1AE (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:sap:s\/4hana:100:*:*:*:*:*:*:* (string)

matchCriteriaId : 11051D6A-FC81-4951-ACDA-BB07D5A5D751 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:sap:s\/4hana:101:*:*:*:*:*:*:* (string)

matchCriteriaId : E6FE144C-BAF2-4E45-93EE-D70764BDEFD6 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:* (string)

matchCriteriaId : 55BACB30-A607-410E-AB05-E991CC19CE12 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:* (string)

matchCriteriaId : 95A0C742-4CBD-46B8-B2B3-5949EFC82A6D (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:* (string)

matchCriteriaId : 14A540DA-F234-4EEA-ADE8-4F6306A86C1E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check. (string)

}

1 : { »

lang : es (string)

value : SAP ERP y SAP S/4 HANA, permiten a un usuario autenticado visualizar los registros de costos de objetos para los que no cuenta con autorización en los reportes de PS, conllevando a una Falta de Comprobación de Autorización (string)

}

]

id : CVE-2020-6316 (string)

lastModified : 2024-11-21T05:35:29.747 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 4 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:S/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : cna@sap.com (string)

type : Secondary (string)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2020-11-10T17:15:15.233 (string)

references : [ »

0 : { »

source : cna@sap.com (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://launchpad.support.sap.com/#/notes/2944188 (string)

}

1 : { »

source : cna@sap.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://launchpad.support.sap.com/#/notes/2944188 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 (string)

}

]

sourceIdentifier : cna@sap.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-862 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object