Read the docs
TI-2020-05168 Aliases CVE-2020-6316GHSA-2j5g-6x52-988w

Missing authorization in SAP ERP

Priority LOW 22CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check.

Why it matters now

EPSS 0.00816 57th percentileScored 2026-11-07
Fix Fixed SAP ERP (SAP SE): 600, 602, 603 +6SAP S/4 HANA (SAP SE): 100, 101, 102 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP ERPbefore 600; before 602; before 603; before 604; before 605; before 606; before 616; before 617; before 618600, 602, 603, 604, 605, 606, 616, 617, 618Patch availableCNA
SAPSAP S/4 HANAbefore 100; before 101; before 102; before 103; before 104100, 101, 102, 103, 104Patch availableCNA
  • SAP ERP VendorSAP Affected before 600; before 602; before 603; before 604; before 605; before 606; before 616; before 617; before 618 Fixed in 600, 602, 603, 604, 605, 606, 616, 617, 618 Patch available CNA
  • SAP S/4 HANA VendorSAP Affected before 100; before 101; before 102; before 103; before 104 Fixed in 100, 101, 102, 103, 104 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:sap:erp:600:*:*:*:*:*:*:*600VulnerableSAP
cpe:2.3:a:sap:erp:602:*:*:*:*:*:*:*602VulnerableSAP
cpe:2.3:a:sap:erp:603:*:*:*:*:*:*:*603VulnerableSAP
cpe:2.3:a:sap:erp:604:*:*:*:*:*:*:*604VulnerableSAP
cpe:2.3:a:sap:erp:605:*:*:*:*:*:*:*605VulnerableSAP
cpe:2.3:a:sap:erp:606:*:*:*:*:*:*:*606VulnerableSAP
cpe:2.3:a:sap:erp:616:*:*:*:*:*:*:*616VulnerableSAP
cpe:2.3:a:sap:erp:617:*:*:*:*:*:*:*617VulnerableSAP
cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*618VulnerableSAP
cpe:2.3:a:sap:s\/4hana:100:*:*:*:*:*:*:*100VulnerableSAP
  • cpe:2.3:a:sap:erp:600:*:*:*:*:*:*:* Versions 600 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp:602:*:*:*:*:*:*:* Versions 602 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp:603:*:*:*:*:*:*:* Versions 603 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp:604:*:*:*:*:*:*:* Versions 604 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp:605:*:*:*:*:*:*:* Versions 605 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp:606:*:*:*:*:*:*:* Versions 606 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp:616:*:*:*:*:*:*:* Versions 616 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp:617:*:*:*:*:*:*:* Versions 617 Vulnerable ·SAP
  • cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:* Versions 618 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:s\/4hana:101:*:*:*:*:*:*:*101VulnerableSAP
cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:*102VulnerableSAP
cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:*103VulnerableSAP
cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:*104VulnerableSAP
  • cpe:2.3:a:sap:s\/4hana:101:*:*:*:*:*:*:* Versions 101 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:* Versions 102 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:* Versions 103 Vulnerable ·SAP
  • cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:* Versions 104 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP ERP (SAP SE) Fixed in 600, 602, 603, 604, 605, 606, 616, 617, 618
  • Fix · CNA SAP S/4 HANA (SAP SE) Fixed in 100, 101, 102, 103, 104

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6316
  2. 2026-10-03 Alias added: GHSA-2j5g-6x52-988w

References

Advisory 1

Other 1

  • TI-2020-05045 Missing authorization in SAP ERP CVSS 3.1HIGH 8.8
  • TI-2026-19607 Multiple vulnerabilities in BSP Applications of SAP Document Management System CVSS 3.1MEDIUM 6.1
  • TI-2026-00313 Multiple vulnerabilities in BSP Applications of SAP Document Management System CVSS 3.1MEDIUM 6.1
  • TI-2020-05068 Missing authorization in SAP ERP CVSS 3.1MEDIUM 5.4
  • TI-2020-05055 Missing authorization in SAP ERP CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences