Medium severity · published Apr 14, 2020
CVE-2020-6214
SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports
4.7
CVSS
0.6%
EPSS
No
On KEV
Description
SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected with other authorization objects, exploitation of the vulnerability would allow an authenticated attacker to view, change, or delete data, thereby preventing the proper segregation of duties in the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S4
S/4hana · Sap
100 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6214
Permissions Required
https://launchpad.support.sap.com/#/notes/2897612
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202
More from S/4hana
9.9
CVE-2026-0488
Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)
8.8
CVE-2021-38176
Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute…
8.1
CVE-2022-22531
The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files
8.1
CVE-2022-22530
The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files
6.5
CVE-2023-24524
SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges