Login Request a demo
Critical severity · published Jun 9, 2020
CVE-2020-6265
SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization…
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Commerce · Sap
6.7; 1808; 1811; 1905 · source: NVD
CD
Commerce Data Hub · Sap
6.7; 1808; 1811; 1905 · source: NVD
Affected product
CO
Commerce
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6265
Permissions Required
https://launchpad.support.sap.com/#/notes/2918924
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775
More from Commerce
9.9
CVE-2021-27602
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when…
9.9
CVE-2021-21477
SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticated attacker with this privilege will be…
9.8
CVE-2021-42064
If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105,…
8.8
CVE-2022-41204
An attacker can change the content of an SAP Commerce - versions 1905, 2005, 2105, 2011, 2205, login page through a manipulated URL
8.8
CVE-2021-40502
SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges