Search criteria
9 vulnerabilities found for treasury_and_risk_management_\(s4core\) by sap
FKIE_CVE-2020-6204
Vulnerability from fkie_nvd - Published: 2020-03-10 21:15 - Updated: 2024-11-21 05:35
Severity ?
Summary
The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):600:*:*:*:*:*:*:*",
"matchCriteriaId": "7EFF8EC8-0C4E-4D93-AECF-6711B470FB54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):603:*:*:*:*:*:*:*",
"matchCriteriaId": "F10EBDE7-0EEE-42E1-A860-ECE0B606D385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):604:*:*:*:*:*:*:*",
"matchCriteriaId": "39437BF7-3C69-43E3-8EFA-EAED49704543",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):605:*:*:*:*:*:*:*",
"matchCriteriaId": "447929D0-5FF0-44EC-99B4-A0A6F3D098AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):606:*:*:*:*:*:*:*",
"matchCriteriaId": "5085EED2-349E-42D2-A5AE-0F307D43C774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):616:*:*:*:*:*:*:*",
"matchCriteriaId": "E4495C9D-8489-4FC1-94F6-84D203F9B388",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):617:*:*:*:*:*:*:*",
"matchCriteriaId": "66AC9F3C-5CE8-4036-9970-5BF9A09C3E06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):618:*:*:*:*:*:*:*",
"matchCriteriaId": "AA62E740-4F8D-4E34-8FFE-AA341963308F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(ea-finserv\\):800:*:*:*:*:*:*:*",
"matchCriteriaId": "349C577E-7966-41CE-A116-4CF9EE47D3D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):101:*:*:*:*:*:*:*",
"matchCriteriaId": "6E21EE73-34F2-4D1C-8C6F-0B0489C049F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):102:*:*:*:*:*:*:*",
"matchCriteriaId": "6B1E8180-D2BB-423C-84BC-CA738F61C518",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):103:*:*:*:*:*:*:*",
"matchCriteriaId": "215CC44C-D4EA-4CAF-946B-5109790F6636",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):104:*:*:*:*:*:*:*",
"matchCriteriaId": "6A389AB7-2487-4AEA-BDA3-3E8CC7BB163F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check."
},
{
"lang": "es",
"value": "La consulta de selecci\u00f3n en SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV versiones 600, 603, 604, 605, 606, 616, 617, 618, 800 y S4CORE versiones 101, 102, 103, 104), devuelve m\u00e1s registros de los que deber\u00edan ser cuando selecciona y despliega el n\u00famero de contrato, conllevando a una Falta de Comprobaci\u00f3n de Autorizaci\u00f3n."
}
],
"id": "CVE-2020-6204",
"lastModified": "2024-11-21T05:35:17.640",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "cna@sap.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-10T21:15:14.527",
"references": [
{
"source": "cna@sap.com",
"tags": [
"Permissions Required"
],
"url": "https://launchpad.support.sap.com/#/notes/2841874"
},
{
"source": "cna@sap.com",
"tags": [
"Vendor Advisory"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
],
"url": "https://launchpad.support.sap.com/#/notes/2841874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
}
],
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2019-0383
Vulnerability from fkie_nvd - Published: 2019-12-17 20:15 - Updated: 2024-11-21 04:16
Severity ?
Summary
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7C94735B-99F4-4B0A-A985-5FE3CD7B8B29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.03:*:*:*:*:*:*:*",
"matchCriteriaId": "B9139751-0E66-45DD-B0CA-8C75AF762E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.04:*:*:*:*:*:*:*",
"matchCriteriaId": "5AC27183-F4D9-430F-884A-A51DC39D9360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.05:*:*:*:*:*:*:*",
"matchCriteriaId": "D7E3267E-9458-473B-8001-2762F4753784",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.06:*:*:*:*:*:*:*",
"matchCriteriaId": "207E235D-3641-4FBD-A165-2D030EBFB1FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.16:*:*:*:*:*:*:*",
"matchCriteriaId": "3726192A-1582-4936-AC2B-7DCBCB6C73C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.17:*:*:*:*:*:*:*",
"matchCriteriaId": "2DAC779F-945A-4F55-B23F-6BF46047A128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.18:*:*:*:*:*:*:*",
"matchCriteriaId": "796D38E2-78CF-4285-AF7C-BBB3C0BC7ED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B601CCAE-2499-4F24-8C85-C28EA2A0486F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "CA33418A-B177-4899-9859-E41CC01A97FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "720812DB-4460-4059-AAD9-C638E71684B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "8EB10799-4688-446B-8D56-B944AD1B8535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "083941A4-561C-4AF8-B1CE-064E481D1921",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges."
},
{
"lang": "es",
"value": "Transaction Management en SAP Treasury and Risk Management (corregida en S4CORE versiones 1.01, 1.02, 1.03, 1.04 y EA-FINSERV versiones 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0), no realiza las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado, resultando en una escalada de privilegios."
}
],
"id": "CVE-2019-0383",
"lastModified": "2024-11-21T04:16:46.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-12-17T20:15:11.227",
"references": [
{
"source": "cna@sap.com",
"tags": [
"Permissions Required"
],
"url": "https://launchpad.support.sap.com/#/notes/2819170"
},
{
"source": "cna@sap.com",
"tags": [
"Vendor Advisory"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
],
"url": "https://launchpad.support.sap.com/#/notes/2819170"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
}
],
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2019-0384
Vulnerability from fkie_nvd - Published: 2019-12-17 20:15 - Updated: 2024-11-21 04:16
Severity ?
Summary
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.
References
| URL | Tags | ||
|---|---|---|---|
| cna@sap.com | https://launchpad.support.sap.com/#/notes/2828981 | Permissions Required, Vendor Advisory | |
| cna@sap.com | https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://launchpad.support.sap.com/#/notes/2828981 | Permissions Required, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7C94735B-99F4-4B0A-A985-5FE3CD7B8B29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.03:*:*:*:*:*:*:*",
"matchCriteriaId": "B9139751-0E66-45DD-B0CA-8C75AF762E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.04:*:*:*:*:*:*:*",
"matchCriteriaId": "5AC27183-F4D9-430F-884A-A51DC39D9360",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.05:*:*:*:*:*:*:*",
"matchCriteriaId": "D7E3267E-9458-473B-8001-2762F4753784",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.06:*:*:*:*:*:*:*",
"matchCriteriaId": "207E235D-3641-4FBD-A165-2D030EBFB1FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.16:*:*:*:*:*:*:*",
"matchCriteriaId": "3726192A-1582-4936-AC2B-7DCBCB6C73C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.17:*:*:*:*:*:*:*",
"matchCriteriaId": "2DAC779F-945A-4F55-B23F-6BF46047A128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:6.18:*:*:*:*:*:*:*",
"matchCriteriaId": "796D38E2-78CF-4285-AF7C-BBB3C0BC7ED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:enterprise_extension_financial_services:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B601CCAE-2499-4F24-8C85-C28EA2A0486F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.01:*:*:*:*:*:*:*",
"matchCriteriaId": "CA33418A-B177-4899-9859-E41CC01A97FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.02:*:*:*:*:*:*:*",
"matchCriteriaId": "720812DB-4460-4059-AAD9-C638E71684B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.03:*:*:*:*:*:*:*",
"matchCriteriaId": "8EB10799-4688-446B-8D56-B944AD1B8535",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sap:treasury_and_risk_management_\\(s4core\\):1.04:*:*:*:*:*:*:*",
"matchCriteriaId": "083941A4-561C-4AF8-B1CE-064E481D1921",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity."
},
{
"lang": "es",
"value": "Transaction Management en SAP Treasury and Risk Management (corregida en S4CORE versiones 1.01, 1.02, 1.03, 1.04 y EA-FINSERV versiones 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0), no realiza las comprobaciones de autorizaci\u00f3n necesarias para funcionalidades que requieren identidad de usuario."
}
],
"id": "CVE-2019-0384",
"lastModified": "2024-11-21T04:16:46.620",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-12-17T20:15:11.430",
"references": [
{
"source": "cna@sap.com",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://launchpad.support.sap.com/#/notes/2828981"
},
{
"source": "cna@sap.com",
"tags": [
"Vendor Advisory"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Vendor Advisory"
],
"url": "https://launchpad.support.sap.com/#/notes/2828981"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
}
],
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2020-6204 (GCVE-0-2020-6204)
Vulnerability from cvelistv5 – Published: 2020-03-10 20:20 – Updated: 2024-08-04 08:55
VLAI?
Summary
The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.
Severity ?
4.3 (Medium)
CWE
- Missing Authorization Check
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| SAP SE | SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) |
Affected:
< 600
Affected: < 603 Affected: < 604 Affected: < 605 Affected: < 606 Affected: < 616 Affected: < 617 Affected: < 618 Affected: < 800 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:55:22.119Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/2841874"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 600"
},
{
"status": "affected",
"version": "\u003c 603"
},
{
"status": "affected",
"version": "\u003c 604"
},
{
"status": "affected",
"version": "\u003c 605"
},
{
"status": "affected",
"version": "\u003c 606"
},
{
"status": "affected",
"version": "\u003c 616"
},
{
"status": "affected",
"version": "\u003c 617"
},
{
"status": "affected",
"version": "\u003c 618"
},
{
"status": "affected",
"version": "\u003c 800"
}
]
},
{
"product": "SAP Treasury and Risk Management (Transaction Management) (S4CORE)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 101"
},
{
"status": "affected",
"version": "\u003c 102"
},
{
"status": "affected",
"version": "\u003c 103"
},
{
"status": "affected",
"version": "\u003c 104"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing Authorization Check",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-10T20:20:12",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://launchpad.support.sap.com/#/notes/2841874"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2020-6204",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "600"
},
{
"version_name": "\u003c",
"version_value": "603"
},
{
"version_name": "\u003c",
"version_value": "604"
},
{
"version_name": "\u003c",
"version_value": "605"
},
{
"version_name": "\u003c",
"version_value": "606"
},
{
"version_name": "\u003c",
"version_value": "616"
},
{
"version_name": "\u003c",
"version_value": "617"
},
{
"version_name": "\u003c",
"version_value": "618"
},
{
"version_name": "\u003c",
"version_value": "800"
}
]
}
},
{
"product_name": "SAP Treasury and Risk Management (Transaction Management) (S4CORE)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "101"
},
{
"version_name": "\u003c",
"version_value": "102"
},
{
"version_name": "\u003c",
"version_value": "103"
},
{
"version_name": "\u003c",
"version_value": "104"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check."
}
]
},
"impact": {
"cvss": {
"baseScore": "4.3",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Missing Authorization Check"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305",
"refsource": "MISC",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
},
{
"name": "https://launchpad.support.sap.com/#/notes/2841874",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2841874"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2020-6204",
"datePublished": "2020-03-10T20:20:12",
"dateReserved": "2020-01-08T00:00:00",
"dateUpdated": "2024-08-04T08:55:22.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-0384 (GCVE-0-2019-0384)
Vulnerability from cvelistv5 – Published: 2019-12-17 19:24 – Updated: 2024-08-04 17:51
VLAI?
Summary
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.
Severity ?
No CVSS data available.
CWE
- Missing Authorization Check
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| SAP SE | SAP Treasury and Risk Management (S4CORE) |
Affected:
< 1.01
Affected: < 1.02 Affected: < 1.03 Affected: < 1.04 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:51:27.032Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/2828981"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP Treasury and Risk Management (S4CORE)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 1.01"
},
{
"status": "affected",
"version": "\u003c 1.02"
},
{
"status": "affected",
"version": "\u003c 1.03"
},
{
"status": "affected",
"version": "\u003c 1.04"
}
]
},
{
"product": "SAP Treasury and Risk Management (EA-FINSERV)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0"
},
{
"status": "affected",
"version": "\u003c 6.03"
},
{
"status": "affected",
"version": "\u003c 6.04"
},
{
"status": "affected",
"version": "\u003c 6.05"
},
{
"status": "affected",
"version": "\u003c 6.06"
},
{
"status": "affected",
"version": "\u003c 6.16"
},
{
"status": "affected",
"version": "\u003c 6.17"
},
{
"status": "affected",
"version": "\u003c 6.18"
},
{
"status": "affected",
"version": "\u003c 8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing Authorization Check",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-17T19:24:06",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://launchpad.support.sap.com/#/notes/2828981"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2019-0384",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP Treasury and Risk Management (S4CORE)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "1.01"
},
{
"version_name": "\u003c",
"version_value": "1.02"
},
{
"version_name": "\u003c",
"version_value": "1.03"
},
{
"version_name": "\u003c",
"version_value": "1.04"
}
]
}
},
{
"product_name": "SAP Treasury and Risk Management (EA-FINSERV)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "6.0"
},
{
"version_name": "\u003c",
"version_value": "6.03"
},
{
"version_name": "\u003c",
"version_value": "6.04"
},
{
"version_name": "\u003c",
"version_value": "6.05"
},
{
"version_name": "\u003c",
"version_value": "6.06"
},
{
"version_name": "\u003c",
"version_value": "6.16"
},
{
"version_name": "\u003c",
"version_value": "6.17"
},
{
"version_name": "\u003c",
"version_value": "6.18"
},
{
"version_name": "\u003c",
"version_value": "8.0"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Missing Authorization Check"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390",
"refsource": "CONFIRM",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
},
{
"name": "https://launchpad.support.sap.com/#/notes/2828981",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2828981"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2019-0384",
"datePublished": "2019-12-17T19:24:06",
"dateReserved": "2018-11-26T00:00:00",
"dateUpdated": "2024-08-04T17:51:27.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-0383 (GCVE-0-2019-0383)
Vulnerability from cvelistv5 – Published: 2019-12-17 19:21 – Updated: 2024-08-04 17:51
VLAI?
Summary
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Severity ?
No CVSS data available.
CWE
- Missing Authorization Check
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| SAP SE | SAP Treasury and Risk Management (S4CORE) |
Affected:
< 1.01
Affected: < 1.02 Affected: < 1.03 Affected: < 1.04 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:51:26.142Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/2819170"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP Treasury and Risk Management (S4CORE)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 1.01"
},
{
"status": "affected",
"version": "\u003c 1.02"
},
{
"status": "affected",
"version": "\u003c 1.03"
},
{
"status": "affected",
"version": "\u003c 1.04"
}
]
},
{
"product": "SAP Treasury and Risk Management (EA-FINSERV)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0"
},
{
"status": "affected",
"version": "\u003c 6.03"
},
{
"status": "affected",
"version": "\u003c 6.04"
},
{
"status": "affected",
"version": "\u003c 6.05"
},
{
"status": "affected",
"version": "\u003c 6.06"
},
{
"status": "affected",
"version": "\u003c 6.16"
},
{
"status": "affected",
"version": "\u003c 6.17"
},
{
"status": "affected",
"version": "\u003c 6.18"
},
{
"status": "affected",
"version": "\u003c 8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing Authorization Check",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-17T19:21:56",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://launchpad.support.sap.com/#/notes/2819170"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2019-0383",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP Treasury and Risk Management (S4CORE)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "1.01"
},
{
"version_name": "\u003c",
"version_value": "1.02"
},
{
"version_name": "\u003c",
"version_value": "1.03"
},
{
"version_name": "\u003c",
"version_value": "1.04"
}
]
}
},
{
"product_name": "SAP Treasury and Risk Management (EA-FINSERV)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "6.0"
},
{
"version_name": "\u003c",
"version_value": "6.03"
},
{
"version_name": "\u003c",
"version_value": "6.04"
},
{
"version_name": "\u003c",
"version_value": "6.05"
},
{
"version_name": "\u003c",
"version_value": "6.06"
},
{
"version_name": "\u003c",
"version_value": "6.16"
},
{
"version_name": "\u003c",
"version_value": "6.17"
},
{
"version_name": "\u003c",
"version_value": "6.18"
},
{
"version_name": "\u003c",
"version_value": "8.0"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Missing Authorization Check"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://launchpad.support.sap.com/#/notes/2819170",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2819170"
},
{
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390",
"refsource": "CONFIRM",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2019-0383",
"datePublished": "2019-12-17T19:21:56",
"dateReserved": "2018-11-26T00:00:00",
"dateUpdated": "2024-08-04T17:51:26.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-6204 (GCVE-0-2020-6204)
Vulnerability from nvd – Published: 2020-03-10 20:20 – Updated: 2024-08-04 08:55
VLAI?
Summary
The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.
Severity ?
4.3 (Medium)
CWE
- Missing Authorization Check
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| SAP SE | SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) |
Affected:
< 600
Affected: < 603 Affected: < 604 Affected: < 605 Affected: < 606 Affected: < 616 Affected: < 617 Affected: < 618 Affected: < 800 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:55:22.119Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/2841874"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 600"
},
{
"status": "affected",
"version": "\u003c 603"
},
{
"status": "affected",
"version": "\u003c 604"
},
{
"status": "affected",
"version": "\u003c 605"
},
{
"status": "affected",
"version": "\u003c 606"
},
{
"status": "affected",
"version": "\u003c 616"
},
{
"status": "affected",
"version": "\u003c 617"
},
{
"status": "affected",
"version": "\u003c 618"
},
{
"status": "affected",
"version": "\u003c 800"
}
]
},
{
"product": "SAP Treasury and Risk Management (Transaction Management) (S4CORE)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 101"
},
{
"status": "affected",
"version": "\u003c 102"
},
{
"status": "affected",
"version": "\u003c 103"
},
{
"status": "affected",
"version": "\u003c 104"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing Authorization Check",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-10T20:20:12",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://launchpad.support.sap.com/#/notes/2841874"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2020-6204",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "600"
},
{
"version_name": "\u003c",
"version_value": "603"
},
{
"version_name": "\u003c",
"version_value": "604"
},
{
"version_name": "\u003c",
"version_value": "605"
},
{
"version_name": "\u003c",
"version_value": "606"
},
{
"version_name": "\u003c",
"version_value": "616"
},
{
"version_name": "\u003c",
"version_value": "617"
},
{
"version_name": "\u003c",
"version_value": "618"
},
{
"version_name": "\u003c",
"version_value": "800"
}
]
}
},
{
"product_name": "SAP Treasury and Risk Management (Transaction Management) (S4CORE)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "101"
},
{
"version_name": "\u003c",
"version_value": "102"
},
{
"version_name": "\u003c",
"version_value": "103"
},
{
"version_name": "\u003c",
"version_value": "104"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check."
}
]
},
"impact": {
"cvss": {
"baseScore": "4.3",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Missing Authorization Check"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305",
"refsource": "MISC",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"
},
{
"name": "https://launchpad.support.sap.com/#/notes/2841874",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2841874"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2020-6204",
"datePublished": "2020-03-10T20:20:12",
"dateReserved": "2020-01-08T00:00:00",
"dateUpdated": "2024-08-04T08:55:22.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-0384 (GCVE-0-2019-0384)
Vulnerability from nvd – Published: 2019-12-17 19:24 – Updated: 2024-08-04 17:51
VLAI?
Summary
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.
Severity ?
No CVSS data available.
CWE
- Missing Authorization Check
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| SAP SE | SAP Treasury and Risk Management (S4CORE) |
Affected:
< 1.01
Affected: < 1.02 Affected: < 1.03 Affected: < 1.04 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:51:27.032Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/2828981"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP Treasury and Risk Management (S4CORE)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 1.01"
},
{
"status": "affected",
"version": "\u003c 1.02"
},
{
"status": "affected",
"version": "\u003c 1.03"
},
{
"status": "affected",
"version": "\u003c 1.04"
}
]
},
{
"product": "SAP Treasury and Risk Management (EA-FINSERV)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0"
},
{
"status": "affected",
"version": "\u003c 6.03"
},
{
"status": "affected",
"version": "\u003c 6.04"
},
{
"status": "affected",
"version": "\u003c 6.05"
},
{
"status": "affected",
"version": "\u003c 6.06"
},
{
"status": "affected",
"version": "\u003c 6.16"
},
{
"status": "affected",
"version": "\u003c 6.17"
},
{
"status": "affected",
"version": "\u003c 6.18"
},
{
"status": "affected",
"version": "\u003c 8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing Authorization Check",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-17T19:24:06",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://launchpad.support.sap.com/#/notes/2828981"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2019-0384",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP Treasury and Risk Management (S4CORE)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "1.01"
},
{
"version_name": "\u003c",
"version_value": "1.02"
},
{
"version_name": "\u003c",
"version_value": "1.03"
},
{
"version_name": "\u003c",
"version_value": "1.04"
}
]
}
},
{
"product_name": "SAP Treasury and Risk Management (EA-FINSERV)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "6.0"
},
{
"version_name": "\u003c",
"version_value": "6.03"
},
{
"version_name": "\u003c",
"version_value": "6.04"
},
{
"version_name": "\u003c",
"version_value": "6.05"
},
{
"version_name": "\u003c",
"version_value": "6.06"
},
{
"version_name": "\u003c",
"version_value": "6.16"
},
{
"version_name": "\u003c",
"version_value": "6.17"
},
{
"version_name": "\u003c",
"version_value": "6.18"
},
{
"version_name": "\u003c",
"version_value": "8.0"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Missing Authorization Check"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390",
"refsource": "CONFIRM",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
},
{
"name": "https://launchpad.support.sap.com/#/notes/2828981",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2828981"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2019-0384",
"datePublished": "2019-12-17T19:24:06",
"dateReserved": "2018-11-26T00:00:00",
"dateUpdated": "2024-08-04T17:51:27.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-0383 (GCVE-0-2019-0383)
Vulnerability from nvd – Published: 2019-12-17 19:21 – Updated: 2024-08-04 17:51
VLAI?
Summary
Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Severity ?
No CVSS data available.
CWE
- Missing Authorization Check
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| SAP SE | SAP Treasury and Risk Management (S4CORE) |
Affected:
< 1.01
Affected: < 1.02 Affected: < 1.03 Affected: < 1.04 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:51:26.142Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/2819170"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP Treasury and Risk Management (S4CORE)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 1.01"
},
{
"status": "affected",
"version": "\u003c 1.02"
},
{
"status": "affected",
"version": "\u003c 1.03"
},
{
"status": "affected",
"version": "\u003c 1.04"
}
]
},
{
"product": "SAP Treasury and Risk Management (EA-FINSERV)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 6.0"
},
{
"status": "affected",
"version": "\u003c 6.03"
},
{
"status": "affected",
"version": "\u003c 6.04"
},
{
"status": "affected",
"version": "\u003c 6.05"
},
{
"status": "affected",
"version": "\u003c 6.06"
},
{
"status": "affected",
"version": "\u003c 6.16"
},
{
"status": "affected",
"version": "\u003c 6.17"
},
{
"status": "affected",
"version": "\u003c 6.18"
},
{
"status": "affected",
"version": "\u003c 8.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing Authorization Check",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-17T19:21:56",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://launchpad.support.sap.com/#/notes/2819170"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2019-0383",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP Treasury and Risk Management (S4CORE)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "1.01"
},
{
"version_name": "\u003c",
"version_value": "1.02"
},
{
"version_name": "\u003c",
"version_value": "1.03"
},
{
"version_name": "\u003c",
"version_value": "1.04"
}
]
}
},
{
"product_name": "SAP Treasury and Risk Management (EA-FINSERV)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "6.0"
},
{
"version_name": "\u003c",
"version_value": "6.03"
},
{
"version_name": "\u003c",
"version_value": "6.04"
},
{
"version_name": "\u003c",
"version_value": "6.05"
},
{
"version_name": "\u003c",
"version_value": "6.06"
},
{
"version_name": "\u003c",
"version_value": "6.16"
},
{
"version_name": "\u003c",
"version_value": "6.17"
},
{
"version_name": "\u003c",
"version_value": "6.18"
},
{
"version_name": "\u003c",
"version_value": "8.0"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Missing Authorization Check"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://launchpad.support.sap.com/#/notes/2819170",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2819170"
},
{
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390",
"refsource": "CONFIRM",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2019-0383",
"datePublished": "2019-12-17T19:21:56",
"dateReserved": "2018-11-26T00:00:00",
"dateUpdated": "2024-08-04T17:51:26.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}