Read the docs
TI-2020-05089 Aliases CVE-2020-6233GHSA-hxp2-q48f-xhqg

Missing authorization in SAP S/4 HANA

Priority LOW 21CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated user to run an analysis report due to Missing Authorization Check, resulting in slowing the system.

Why it matters now

EPSS 0.00742 54th percentileScored 2026-11-07
Fix Fixed SAP S/4 HANA (Financial Products Subledger and Banking Services) (FSAPPL) (SAP SE): 400, 450, 500SAP S/4 HANA (Financial Products Subledger and Banking Services) (S4FPSL) (SAP SE): 100

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP S/4 HANA (Financial Products Subledger and Banking Services) (FSAPPL)before 400; before 450; before 500400, 450, 500Patch availableCNA
SAPSAP S/4 HANA (Financial Products Subledger and Banking Services) (S4FPSL)before 100100Patch availableCNA
  • SAP S/4 HANA (Financial Products Subledger and Banking Services) (FSAPPL) VendorSAP Affected before 400; before 450; before 500 Fixed in 400, 450, 500 Patch available CNA
  • SAP S/4 HANA (Financial Products Subledger and Banking Services) (S4FPSL) VendorSAP Affected before 100 Fixed in 100 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:sap:banking_services_from_sap:400:*:*:*:*:*:*:*400VulnerableSAP
cpe:2.3:a:sap:banking_services_from_sap:450:*:*:*:*:*:*:*450VulnerableSAP
cpe:2.3:a:sap:banking_services_from_sap:500:*:*:*:*:*:*:*500VulnerableSAP
cpe:2.3:a:sap:s\/4hana_financial_products_subledger:100:*:*:*:*:*:*:*100VulnerableSAP
  • cpe:2.3:a:sap:banking_services_from_sap:400:*:*:*:*:*:*:* Versions 400 Vulnerable ·SAP
  • cpe:2.3:a:sap:banking_services_from_sap:450:*:*:*:*:*:*:* Versions 450 Vulnerable ·SAP
  • cpe:2.3:a:sap:banking_services_from_sap:500:*:*:*:*:*:*:* Versions 500 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana_financial_products_subledger:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP S/4 HANA (Financial Products Subledger and Banking Services) (FSAPPL) (SAP SE) Fixed in 400, 450, 500
  • Fix · CNA SAP S/4 HANA (Financial Products Subledger and Banking Services) (S4FPSL) (SAP SE) Fixed in 100

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6233
  2. 2026-10-03 Alias added: GHSA-hxp2-q48f-xhqg

References

Advisory 2

  • TI-2019-00237 Incorrect authorization in SAP Banking services from SAP 9.0 CVSS 3.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences