Missing authorization in SAP Treasury and Risk Management
Priority LOW 21CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.
Why it matters now
EPSS 0.00627 50th percentileScored 2026-11-07
Fix Fixed SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) (SAP SE): 600, 603, 604 +6SAP Treasury and Risk Management (Transaction Management) (S4CORE) (SAP SE): 101, 102, 103 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) | before 600; before 603; before 604; before 605; before 606; before 616; before 617; before 618; before 800 | 600, 603, 604, 605, 606, 616, 617, 618, 800 | Patch available | CNA |
| SAP | SAP Treasury and Risk Management (Transaction Management) (S4CORE) | before 101; before 102; before 103; before 104 | 101, 102, 103, 104 | Patch available | CNA |
- SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) VendorSAP Affected before 600; before 603; before 604; before 605; before 606; before 616; before 617; before 618; before 800 Fixed in 600, 603, 604, 605, 606, 616, 617, 618, 800 Patch available CNA
- SAP Treasury and Risk Management (Transaction Management) (S4CORE) VendorSAP Affected before 101; before 102; before 103; before 104 Fixed in 101, 102, 103, 104 Patch available CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):600:*:*:*:*:*:*:* | 600 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):603:*:*:*:*:*:*:* | 603 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):604:*:*:*:*:*:*:* | 604 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):605:*:*:*:*:*:*:* | 605 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):606:*:*:*:*:*:*:* | 606 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):616:*:*:*:*:*:*:* | 616 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):617:*:*:*:*:*:*:* | 617 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):618:*:*:*:*:*:*:* | 618 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):800:*:*:*:*:*:*:* | 800 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(s4core\):101:*:*:*:*:*:*:* | 101 | Vulnerable | SAP |
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):600:*:*:*:*:*:*:* Versions 600 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):603:*:*:*:*:*:*:* Versions 603 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):604:*:*:*:*:*:*:* Versions 604 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):605:*:*:*:*:*:*:* Versions 605 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):606:*:*:*:*:*:*:* Versions 606 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):616:*:*:*:*:*:*:* Versions 616 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):617:*:*:*:*:*:*:* Versions 617 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):618:*:*:*:*:*:*:* Versions 618 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(ea-finserv\):800:*:*:*:*:*:*:* Versions 800 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(s4core\):101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:treasury_and_risk_management_\(s4core\):102:*:*:*:*:*:*:* | 102 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(s4core\):103:*:*:*:*:*:*:* | 103 | Vulnerable | SAP |
| cpe:2.3:a:sap:treasury_and_risk_management_\(s4core\):104:*:*:*:*:*:*:* | 104 | Vulnerable | SAP |
- cpe:2.3:a:sap:treasury_and_risk_management_\(s4core\):102:*:*:*:*:*:*:* Versions 102 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(s4core\):103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
- cpe:2.3:a:sap:treasury_and_risk_management_\(s4core\):104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) (SAP SE) Fixed in 600, 603, 604, 605, 606, 616, 617, 618, 800
- Fix · CNA SAP Treasury and Risk Management (Transaction Management) (S4CORE) (SAP SE) Fixed in 101, 102, 103, 104
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6204
- 2026-10-03 Alias added: GHSA-whqr-v2xf-6j78
- 2026-10-30 EPSS moved to the 50th–90th percentile
References
Sources
- CVE-2020-6204 · CVE Program
- CVE-2020-6204 · NVD
- FIRST EPSS
- GHSA-whqr-v2xf-6j78 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences