Skip to content
OpenAdvisories
Medium · 4.3 CVE-2020-6204 EUVD-2020-27354GHSA-whqr-v2xf-6j78

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 61…

Published Mar 10, 2020 · Updated Aug 4, 2024 · Assigned by sap

Description

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.

Affected products

VendorProductAffectedFixed
SAP SE SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) < 600, < 603, < 604, < 605, < 606, < 616, < 617, < 618, < 800 —
SAP SE SAP Treasury and Risk Management (Transaction Management) (S4CORE) < 101, < 102, < 103, < 104 —

References