CVE-2020-6249

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-12 · updated 2026-06-17
Weakness: CWE-89

Description

The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.

Affected products

SAP Master Data Governance (S4Core): 101
SAP Master Data Governance (S4Fnd): 102, 103, 104
SAP Master Data Governance (Sap Bs Fnd): 748

References

https://launchpad.support.sap.com/#/notes/2908560
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222
https://launchpad.support.sap.com/#/notes/2908560
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222

Get alerted when CVE-2020-6249 or the next vulnerability affects your stack