VulnerabilityModified
CVE-2020-6307
Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization checks leading to the reading of sensitive information.
MEDIUM 4.3EPSS 0.72%
Does this matter?
Lower severity and a low EPSS score (0.72%). Track it; it rarely justifies an emergency change on its own.
Description
Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization checks leading to the reading of sensitive information.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- sap/basis
- Source
- cna@sap.com
References
- https://launchpad.support.sap.com/#/notes/2863397Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2863397Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.