CVE-2020-6268

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-10 · updated 2026-06-17
Weakness: CWE-862

Description

Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check.

Affected products

SAP Erp (Ea-Finserv): 600, 603, 604, 605, 606, 616 (+3)
SAP Erp (S4Core): 101, 102, 103, 104

References

https://launchpad.support.sap.com/#/notes/2906996
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775
https://launchpad.support.sap.com/#/notes/2906996
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775

Get alerted when CVE-2020-6268 or the next vulnerability affects your stack