VulnerabilityModified
CVE-2020-6239
Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure.
MEDIUM 4.4EPSS 0.32%
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure.
- CVSS 3.1
- 4.4 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.32% probability · 24th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-522
- Affected
- sap/business one
- Source
- cna@sap.com
References
- https://launchpad.support.sap.com/#/notes/2908382Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2908382Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.