Medium severity · published Mar 10, 2020
CVE-2020-6199
The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions-…
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization Check.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
Erp · Sap
607 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6199
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6199
Permissions Required
https://launchpad.support.sap.com/#/notes/2871167
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
More from Erp
8.8
CVE-2020-6188
VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103,…
6.1
CVE-2026-24323
Multiple vulnerabilities in BSP Applications of SAP Document Management System
6.1
CVE-2026-0505
Multiple vulnerabilities in BSP Applications of SAP Document Management System
5.4
CVE-2020-6212
Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101,…
4.3
CVE-2020-6316
SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check