Read the docs
TI-2020-05084 Aliases CVE-2020-6228GHSA-42h8-r672-w9r8

SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which…

Priority LOW 33CWE-354Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify the installer.

Why it matters now

EPSS 0.00381 32nd percentileScored 2026-11-07
Fix Fixed SAP Business Client (SAP SE): 6.5, 7.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Business Clientbefore 6.5; before 7.06.5, 7.0Patch availableCNA
  • SAP Business Client VendorSAP Affected before 6.5; before 7.0 Fixed in 6.5, 7.0 Patch available CNA

CPE configurations NVD · 45

CPEVersionsRoleVendor
cpe:2.3:a:sap:business_client:6.0:-:*:*:*:*:*:*6.0VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level1:*:*:*:*:*:*6.0 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level10:*:*:*:*:*:*6.0 patch_level10VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level11:*:*:*:*:*:*6.0 patch_level11VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level12:*:*:*:*:*:*6.0 patch_level12VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level13:*:*:*:*:*:*6.0 patch_level13VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level14:*:*:*:*:*:*6.0 patch_level14VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level15:*:*:*:*:*:*6.0 patch_level15VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level16:*:*:*:*:*:*6.0 patch_level16VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level17:*:*:*:*:*:*6.0 patch_level17VulnerableSAP
  • cpe:2.3:a:sap:business_client:6.0:-:*:*:*:*:*:* Versions 6.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level1:*:*:*:*:*:* Versions 6.0 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level10:*:*:*:*:*:* Versions 6.0 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level11:*:*:*:*:*:* Versions 6.0 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level12:*:*:*:*:*:* Versions 6.0 patch_level12 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level13:*:*:*:*:*:* Versions 6.0 patch_level13 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level14:*:*:*:*:*:* Versions 6.0 patch_level14 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level15:*:*:*:*:*:* Versions 6.0 patch_level15 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level16:*:*:*:*:*:* Versions 6.0 patch_level16 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level17:*:*:*:*:*:* Versions 6.0 patch_level17 Vulnerable ·SAP
Show 35 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:business_client:6.0:patch_level2:*:*:*:*:*:*6.0 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level3:*:*:*:*:*:*6.0 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level4:*:*:*:*:*:*6.0 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level5:*:*:*:*:*:*6.0 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level6:*:*:*:*:*:*6.0 patch_level6VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level7:*:*:*:*:*:*6.0 patch_level7VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level8:*:*:*:*:*:*6.0 patch_level8VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level9:*:*:*:*:*:*6.0 patch_level9VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:-:*:*:*:*:*:*6.5VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level1:*:*:*:*:*:*6.5 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level10:*:*:*:*:*:*6.5 patch_level10VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level11:*:*:*:*:*:*6.5 patch_level11VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level12:*:*:*:*:*:*6.5 patch_level12VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level13:*:*:*:*:*:*6.5 patch_level13VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level14:*:*:*:*:*:*6.5 patch_level14VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level15:*:*:*:*:*:*6.5 patch_level15VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level16:*:*:*:*:*:*6.5 patch_level16VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level17:*:*:*:*:*:*6.5 patch_level17VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level18:*:*:*:*:*:*6.5 patch_level18VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level19:*:*:*:*:*:*6.5 patch_level19VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level2:*:*:*:*:*:*6.5 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level3:*:*:*:*:*:*6.5 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level4:*:*:*:*:*:*6.5 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level5:*:*:*:*:*:*6.5 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level6:*:*:*:*:*:*6.5 patch_level6VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level7:*:*:*:*:*:*6.5 patch_level7VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level8:*:*:*:*:*:*6.5 patch_level8VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level9:*:*:*:*:*:*6.5 patch_level9VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:-:*:*:*:*:*:*7.0VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level1:*:*:*:*:*:*7.0 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level2:*:*:*:*:*:*7.0 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level3:*:*:*:*:*:*7.0 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level4:*:*:*:*:*:*7.0 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level5:*:*:*:*:*:*7.0 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level6:*:*:*:*:*:*7.0 patch_level6VulnerableSAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level2:*:*:*:*:*:* Versions 6.0 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level3:*:*:*:*:*:* Versions 6.0 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level4:*:*:*:*:*:* Versions 6.0 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level5:*:*:*:*:*:* Versions 6.0 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level6:*:*:*:*:*:* Versions 6.0 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level7:*:*:*:*:*:* Versions 6.0 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level8:*:*:*:*:*:* Versions 6.0 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level9:*:*:*:*:*:* Versions 6.0 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:-:*:*:*:*:*:* Versions 6.5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level1:*:*:*:*:*:* Versions 6.5 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level10:*:*:*:*:*:* Versions 6.5 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level11:*:*:*:*:*:* Versions 6.5 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level12:*:*:*:*:*:* Versions 6.5 patch_level12 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level13:*:*:*:*:*:* Versions 6.5 patch_level13 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level14:*:*:*:*:*:* Versions 6.5 patch_level14 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level15:*:*:*:*:*:* Versions 6.5 patch_level15 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level16:*:*:*:*:*:* Versions 6.5 patch_level16 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level17:*:*:*:*:*:* Versions 6.5 patch_level17 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level18:*:*:*:*:*:* Versions 6.5 patch_level18 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level19:*:*:*:*:*:* Versions 6.5 patch_level19 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level2:*:*:*:*:*:* Versions 6.5 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level3:*:*:*:*:*:* Versions 6.5 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level4:*:*:*:*:*:* Versions 6.5 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level5:*:*:*:*:*:* Versions 6.5 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level6:*:*:*:*:*:* Versions 6.5 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level7:*:*:*:*:*:* Versions 6.5 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level8:*:*:*:*:*:* Versions 6.5 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level9:*:*:*:*:*:* Versions 6.5 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level1:*:*:*:*:*:* Versions 7.0 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level2:*:*:*:*:*:* Versions 7.0 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level3:*:*:*:*:*:* Versions 7.0 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level4:*:*:*:*:*:* Versions 7.0 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level5:*:*:*:*:*:* Versions 7.0 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level6:*:*:*:*:*:* Versions 7.0 patch_level6 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Business Client (SAP SE) Fixed in 6.5, 7.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6228
  2. 2026-10-03 Alias added: GHSA-42h8-r672-w9r8

References

Advisory 2

  • TI-2018-01786 Under certain conditions SAP Business Client 6.5 allows an attacker to access information… CVSS 3.1HIGH 7.5
  • TI-2020-05100 Uncontrolled search path in SAP Business Client CVSS 3.1HIGH 7.8
  • TI-2021-15830 Cleartext storage of sensitive information in SAP Business Client CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences