TI-2020-05153 Aliases CVE-2020-6301 GHSA-jrpm-x59j-5pxj

Missing authorization in SAP ERP

LOW 36CWE-862Published 2020-08-12 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP ERP (HCM Travel Management), versions - 600, 602, 603, 604, 605, 606, 607, 608, allows an authenticated but unauthorized attacker to read, modify and settle trips, resulting in escalation of privileges, due to Missing Authorization Check.

Why it matters now

EPSS 0.00709 53rd percentileScored 2026-11-07

Fix Fixed SAP ERP (HCM Travel Management) (SAP SE): 600, 602, 603 +5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP ERP (HCM Travel Management)	before 600; before 602; before 603; before 604; before 605; before 606; before 607; before 608	600, 602, 603, 604, 605, 606, 607, 608	Patch available	CNA

SAP ERP (HCM Travel Management) VendorSAP Affected before 600; before 602; before 603; before 604; before 605; before 606; before 607; before 608 Fixed in 600, 602, 603, 604, 605, 606, 607, 608 Patch available CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:hcm_travel_management:600:::::::*	600	Vulnerable	SAP
cpe:2.3:a:sap:hcm_travel_management:602:::::::*	602	Vulnerable	SAP
cpe:2.3:a:sap:hcm_travel_management:603:::::::*	603	Vulnerable	SAP
cpe:2.3:a:sap:hcm_travel_management:604:::::::*	604	Vulnerable	SAP
cpe:2.3:a:sap:hcm_travel_management:605:::::::*	605	Vulnerable	SAP
cpe:2.3:a:sap:hcm_travel_management:606:::::::*	606	Vulnerable	SAP
cpe:2.3:a:sap:hcm_travel_management:607:::::::*	607	Vulnerable	SAP
cpe:2.3:a:sap:hcm_travel_management:608:::::::*	608	Vulnerable	SAP

cpe:2.3:a:sap:hcm_travel_management:600:*:*:*:*:*:*:* Versions 600 Vulnerable ·SAP
cpe:2.3:a:sap:hcm_travel_management:602:*:*:*:*:*:*:* Versions 602 Vulnerable ·SAP
cpe:2.3:a:sap:hcm_travel_management:603:*:*:*:*:*:*:* Versions 603 Vulnerable ·SAP
cpe:2.3:a:sap:hcm_travel_management:604:*:*:*:*:*:*:* Versions 604 Vulnerable ·SAP
cpe:2.3:a:sap:hcm_travel_management:605:*:*:*:*:*:*:* Versions 605 Vulnerable ·SAP
cpe:2.3:a:sap:hcm_travel_management:606:*:*:*:*:*:*:* Versions 606 Vulnerable ·SAP
cpe:2.3:a:sap:hcm_travel_management:607:*:*:*:*:*:*:* Versions 607 Vulnerable ·SAP
cpe:2.3:a:sap:hcm_travel_management:608:*:*:*:*:*:*:* Versions 608 Vulnerable ·SAP

Remediation

Fix · CNA SAP ERP (HCM Travel Management) (SAP SE) Fixed in 600, 602, 603, 604, 605, 606, 607, 608

Timeline

2026-10-02 Threatist record created from CVE-2020-6301
2026-10-03 Alias added: GHSA-jrpm-x59j-5pxj

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345

Other 1

https://launchpad.support.sap.com/#/notes/2949196

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences