TI-2020-05055 Aliases CVE-2020-6199 GHSA-pq6j-qh22-66qx

Missing authorization in SAP ERP

LOW 24CWE-862Published 2020-03-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization Check.

Why it matters now

EPSS 0.00334 26th percentileScored 2026-11-07

Fix Fixed SAP ERP (EAPPGLO) (SAP SE): 607SAP ERP (SAP_FIN) (SAP SE): 618, 730+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP ERP (EAPPGLO)	before 607	607	Patch available	CNA
SAP	SAP ERP (SAP_FIN)	before 618; before 730	618, 730	Patch available	CNA
SAP	SAP S/4HANA (S4CORE)	before 100; before 101; before 102; before 103; before 104	100, 101, 102, 103, 104	Patch available	CNA

SAP ERP (EAPPGLO) VendorSAP Affected before 607 Fixed in 607 Patch available CNA
SAP ERP (SAP_FIN) VendorSAP Affected before 618; before 730 Fixed in 618, 730 Patch available CNA
SAP S/4HANA (S4CORE) VendorSAP Affected before 100; before 101; before 102; before 103; before 104 Fixed in 100, 101, 102, 103, 104 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:erp:607:::::::*	607	Vulnerable	SAP

cpe:2.3:a:sap:erp:607:*:*:*:*:*:*:* Versions 607 Vulnerable ·SAP

Remediation

Fix · CNA SAP ERP (EAPPGLO) (SAP SE) Fixed in 607
Fix · CNA SAP ERP (SAP_FIN) (SAP SE) Fixed in 618, 730
Fix · CNA SAP S/4HANA (S4CORE) (SAP SE) Fixed in 100, 101, 102, 103, 104

Timeline

2026-10-02 Threatist record created from CVE-2020-6199
2026-10-03 Alias added: GHSA-pq6j-qh22-66qx

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305

Other 1

https://launchpad.support.sap.com/#/notes/2871167

TI-2020-05045 Missing authorization in SAP ERP CVSS 3.1HIGH 8.8
TI-2026-19607 Multiple vulnerabilities in BSP Applications of SAP Document Management System CVSS 3.1MEDIUM 6.1
TI-2026-00313 Multiple vulnerabilities in BSP Applications of SAP Document Management System CVSS 3.1MEDIUM 6.1
TI-2020-05068 Missing authorization in SAP ERP CVSS 3.1MEDIUM 5.4
TI-2020-05168 Missing authorization in SAP ERP CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences