High severity · published Feb 12, 2020
CVE-2020-6188
VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103,…
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
Erp · Sap
6.0 · source: NVD
SH
S/4 Hana · Sap
1511; 1610; 1709; 1809; 1909 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6188
Permissions Required
https://launchpad.support.sap.com/#/notes/2857511
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812
More from Erp
6.1
CVE-2026-24323
Multiple vulnerabilities in BSP Applications of SAP Document Management System
6.1
CVE-2026-0505
Multiple vulnerabilities in BSP Applications of SAP Document Management System
5.4
CVE-2020-6212
Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101,…
5.4
CVE-2020-6199
The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions-…
4.3
CVE-2020-6316
SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check