Read the docs
TI-2020-05123 Aliases CVE-2020-6268GHSA-c687-3w98-pg2q

Missing authorization in SAP ERP

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.

Why it matters now

EPSS 0.00675 52nd percentileScored 2026-11-07
Fix Fixed SAP ERP (Statutory Reporting for Insurance Companies) (SAP SE): 603, 604, 605 +7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP ERP (Statutory Reporting for Insurance Companies)< EA-FINSERV 600; before 603; before 604; before 605; before 606; before 616; before 617; before 618; < 800S4CORE 101; before 102; before 103; before 104603, 604, 605, 606, 616, 617, 618, 102, 103, 104Patch availableCNA
  • SAP ERP (Statutory Reporting for Insurance Companies) VendorSAP Affected < EA-FINSERV 600; before 603; before 604; before 605; before 606; before 616; before 617; before 618; < 800S4CORE 101; before 102; before 103; before 104 Fixed in 603, 604, 605, 606, 616, 617, 618, 102, 103, 104 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:sap:erp_\(ea-finserv\):600:*:*:*:*:*:*:*600VulnerableSAP
cpe:2.3:a:sap:erp_\(ea-finserv\):603:*:*:*:*:*:*:*603VulnerableSAP
cpe:2.3:a:sap:erp_\(ea-finserv\):604:*:*:*:*:*:*:*604VulnerableSAP
cpe:2.3:a:sap:erp_\(ea-finserv\):605:*:*:*:*:*:*:*605VulnerableSAP
cpe:2.3:a:sap:erp_\(ea-finserv\):606:*:*:*:*:*:*:*606VulnerableSAP
cpe:2.3:a:sap:erp_\(ea-finserv\):616:*:*:*:*:*:*:*616VulnerableSAP
cpe:2.3:a:sap:erp_\(ea-finserv\):617:*:*:*:*:*:*:*617VulnerableSAP
cpe:2.3:a:sap:erp_\(ea-finserv\):618:*:*:*:*:*:*:*618VulnerableSAP
cpe:2.3:a:sap:erp_\(ea-finserv\):800:*:*:*:*:*:*:*800VulnerableSAP
cpe:2.3:a:sap:erp_\(s4core\):101:*:*:*:*:*:*:*101VulnerableSAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):600:*:*:*:*:*:*:* Versions 600 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):603:*:*:*:*:*:*:* Versions 603 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):604:*:*:*:*:*:*:* Versions 604 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):605:*:*:*:*:*:*:* Versions 605 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):606:*:*:*:*:*:*:* Versions 606 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):616:*:*:*:*:*:*:* Versions 616 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):617:*:*:*:*:*:*:* Versions 617 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):618:*:*:*:*:*:*:* Versions 618 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(ea-finserv\):800:*:*:*:*:*:*:* Versions 800 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(s4core\):101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:erp_\(s4core\):102:*:*:*:*:*:*:*102VulnerableSAP
cpe:2.3:a:sap:erp_\(s4core\):103:*:*:*:*:*:*:*103VulnerableSAP
cpe:2.3:a:sap:erp_\(s4core\):104:*:*:*:*:*:*:*104VulnerableSAP
  • cpe:2.3:a:sap:erp_\(s4core\):102:*:*:*:*:*:*:* Versions 102 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(s4core\):103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp_\(s4core\):104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP ERP (Statutory Reporting for Insurance Companies) (SAP SE) Fixed in 603, 604, 605, 606, 616, 617, 618, 102, 103, 104

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6268
  2. 2026-10-03 Alias added: GHSA-c687-3w98-pg2q

References

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences