Read the docs
TI-2020-05100 Aliases CVE-2020-6244GHSA-4wrg-fcqh-8cg6

Uncontrolled search path in SAP Business Client

Priority LOW 34CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the application.

Why it matters now

EPSS 0.00337 27th percentileScored 2026-11-07
Fix Fixed SAP Business Client (SAP SE): 7.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Business Clientbefore 7.07.0Patch availableCNA
  • SAP Business Client VendorSAP Affected before 7.0 Fixed in 7.0 Patch available CNA

CPE configurations NVD · 51

CPEVersionsRoleVendor
cpe:2.3:a:sap:business_client:6.0:-:*:*:*:*:*:*6.0VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level1:*:*:*:*:*:*6.0 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level10:*:*:*:*:*:*6.0 patch_level10VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level11:*:*:*:*:*:*6.0 patch_level11VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level12:*:*:*:*:*:*6.0 patch_level12VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level13:*:*:*:*:*:*6.0 patch_level13VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level14:*:*:*:*:*:*6.0 patch_level14VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level15:*:*:*:*:*:*6.0 patch_level15VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level16:*:*:*:*:*:*6.0 patch_level16VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level17:*:*:*:*:*:*6.0 patch_level17VulnerableSAP
  • cpe:2.3:a:sap:business_client:6.0:-:*:*:*:*:*:* Versions 6.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level1:*:*:*:*:*:* Versions 6.0 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level10:*:*:*:*:*:* Versions 6.0 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level11:*:*:*:*:*:* Versions 6.0 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level12:*:*:*:*:*:* Versions 6.0 patch_level12 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level13:*:*:*:*:*:* Versions 6.0 patch_level13 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level14:*:*:*:*:*:* Versions 6.0 patch_level14 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level15:*:*:*:*:*:* Versions 6.0 patch_level15 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level16:*:*:*:*:*:* Versions 6.0 patch_level16 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level17:*:*:*:*:*:* Versions 6.0 patch_level17 Vulnerable ·SAP
Show 41 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:business_client:6.0:patch_level2:*:*:*:*:*:*6.0 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level3:*:*:*:*:*:*6.0 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level4:*:*:*:*:*:*6.0 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level5:*:*:*:*:*:*6.0 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level6:*:*:*:*:*:*6.0 patch_level6VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level7:*:*:*:*:*:*6.0 patch_level7VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level8:*:*:*:*:*:*6.0 patch_level8VulnerableSAP
cpe:2.3:a:sap:business_client:6.0:patch_level9:*:*:*:*:*:*6.0 patch_level9VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:-:*:*:*:*:*:*6.5VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level1:*:*:*:*:*:*6.5 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level10:*:*:*:*:*:*6.5 patch_level10VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level11:*:*:*:*:*:*6.5 patch_level11VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level12:*:*:*:*:*:*6.5 patch_level12VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level13:*:*:*:*:*:*6.5 patch_level13VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level14:*:*:*:*:*:*6.5 patch_level14VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level15:*:*:*:*:*:*6.5 patch_level15VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level16:*:*:*:*:*:*6.5 patch_level16VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level17:*:*:*:*:*:*6.5 patch_level17VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level18:*:*:*:*:*:*6.5 patch_level18VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level19:*:*:*:*:*:*6.5 patch_level19VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level2:*:*:*:*:*:*6.5 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level20:*:*:*:*:*:*6.5 patch_level20VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level21:*:*:*:*:*:*6.5 patch_level21VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level22:*:*:*:*:*:*6.5 patch_level22VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level3:*:*:*:*:*:*6.5 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level4:*:*:*:*:*:*6.5 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level5:*:*:*:*:*:*6.5 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level6:*:*:*:*:*:*6.5 patch_level6VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level7:*:*:*:*:*:*6.5 patch_level7VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level8:*:*:*:*:*:*6.5 patch_level8VulnerableSAP
cpe:2.3:a:sap:business_client:6.5:patch_level9:*:*:*:*:*:*6.5 patch_level9VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:-:*:*:*:*:*:*7.0VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level1:*:*:*:*:*:*7.0 patch_level1VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level2:*:*:*:*:*:*7.0 patch_level2VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level3:*:*:*:*:*:*7.0 patch_level3VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level4:*:*:*:*:*:*7.0 patch_level4VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level5:*:*:*:*:*:*7.0 patch_level5VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level6:*:*:*:*:*:*7.0 patch_level6VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level7:*:*:*:*:*:*7.0 patch_level7VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level8:*:*:*:*:*:*7.0 patch_level8VulnerableSAP
cpe:2.3:a:sap:business_client:7.0:patch_level9:*:*:*:*:*:*7.0 patch_level9VulnerableSAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level2:*:*:*:*:*:* Versions 6.0 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level3:*:*:*:*:*:* Versions 6.0 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level4:*:*:*:*:*:* Versions 6.0 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level5:*:*:*:*:*:* Versions 6.0 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level6:*:*:*:*:*:* Versions 6.0 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level7:*:*:*:*:*:* Versions 6.0 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level8:*:*:*:*:*:* Versions 6.0 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.0:patch_level9:*:*:*:*:*:* Versions 6.0 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:-:*:*:*:*:*:* Versions 6.5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level1:*:*:*:*:*:* Versions 6.5 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level10:*:*:*:*:*:* Versions 6.5 patch_level10 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level11:*:*:*:*:*:* Versions 6.5 patch_level11 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level12:*:*:*:*:*:* Versions 6.5 patch_level12 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level13:*:*:*:*:*:* Versions 6.5 patch_level13 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level14:*:*:*:*:*:* Versions 6.5 patch_level14 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level15:*:*:*:*:*:* Versions 6.5 patch_level15 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level16:*:*:*:*:*:* Versions 6.5 patch_level16 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level17:*:*:*:*:*:* Versions 6.5 patch_level17 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level18:*:*:*:*:*:* Versions 6.5 patch_level18 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level19:*:*:*:*:*:* Versions 6.5 patch_level19 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level2:*:*:*:*:*:* Versions 6.5 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level20:*:*:*:*:*:* Versions 6.5 patch_level20 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level21:*:*:*:*:*:* Versions 6.5 patch_level21 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level22:*:*:*:*:*:* Versions 6.5 patch_level22 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level3:*:*:*:*:*:* Versions 6.5 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level4:*:*:*:*:*:* Versions 6.5 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level5:*:*:*:*:*:* Versions 6.5 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level6:*:*:*:*:*:* Versions 6.5 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level7:*:*:*:*:*:* Versions 6.5 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level8:*:*:*:*:*:* Versions 6.5 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:6.5:patch_level9:*:*:*:*:*:* Versions 6.5 patch_level9 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level1:*:*:*:*:*:* Versions 7.0 patch_level1 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level2:*:*:*:*:*:* Versions 7.0 patch_level2 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level3:*:*:*:*:*:* Versions 7.0 patch_level3 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level4:*:*:*:*:*:* Versions 7.0 patch_level4 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level5:*:*:*:*:*:* Versions 7.0 patch_level5 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level6:*:*:*:*:*:* Versions 7.0 patch_level6 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level7:*:*:*:*:*:* Versions 7.0 patch_level7 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level8:*:*:*:*:*:* Versions 7.0 patch_level8 Vulnerable ·SAP
  • cpe:2.3:a:sap:business_client:7.0:patch_level9:*:*:*:*:*:* Versions 7.0 patch_level9 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP Business Client (SAP SE) Fixed in 7.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6244
  2. 2026-10-03 Alias added: GHSA-4wrg-fcqh-8cg6

References

Advisory 1

Other 1

  • TI-2018-01786 Under certain conditions SAP Business Client 6.5 allows an attacker to access information… CVSS 3.1HIGH 7.5
  • TI-2020-05084 SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which… CVSS 3.1HIGH 7.5
  • TI-2021-15830 Cleartext storage of sensitive information in SAP Business Client CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences