Read the docs
TI-2020-05163 Aliases CVE-2020-6311GHSA-9w4c-84x2-59qr

Improper authorization in SAP BANKING SERVICES FROM SAP 9.0

Priority LOW 31CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

Banking services from SAP 9.0 (Bank Analyzer), version - 500, and SAP S/4HANA for financial products subledger, version � 100, does not correctly perform necessary authorization checks for an authenticated user due to Improper Authorization checks, that may cause a system administrator to create incorrect authorization proposals. This may result in privilege escalation and may expose restricted banking data.

Why it matters now

EPSS 0.0102 63rd percentileScored 2026-11-07
Fix Fixed BANKING SERVICES FROM SAP 9.0(Bank Analyzer) (SAP SE): 500S/4HANA FIN PROD SUBLDGR (SAP SE): 100

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPBANKING SERVICES FROM SAP 9.0(Bank Analyzer)before 500500Patch availableCNA
SAPS/4HANA FIN PROD SUBLDGRbefore 100100Patch availableCNA
  • BANKING SERVICES FROM SAP 9.0(Bank Analyzer) VendorSAP Affected before 500 Fixed in 500 Patch available CNA
  • S/4HANA FIN PROD SUBLDGR VendorSAP Affected before 100 Fixed in 100 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sap:bank_analyzer:500:*:*:*:*:*:*:*500VulnerableSAP
cpe:2.3:a:sap:s\/4hana_for_financial_products_subledger:100:*:*:*:*:*:*:*100VulnerableSAP
  • cpe:2.3:a:sap:bank_analyzer:500:*:*:*:*:*:*:* Versions 500 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana_for_financial_products_subledger:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP

Remediation

  • Fix · CNA BANKING SERVICES FROM SAP 9.0(Bank Analyzer) (SAP SE) Fixed in 500
  • Fix · CNA S/4HANA FIN PROD SUBLDGR (SAP SE) Fixed in 100

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6311
  2. 2026-10-03 Alias added: GHSA-9w4c-84x2-59qr

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences