High severity · published Jul 14, 2020
CVE-2020-6291
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient…
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Disclosure Management · Sap
10.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6291
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6291
Permissions Required
https://launchpad.support.sap.com/#/notes/2758000
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
More from Disclosure Management
9.8
CVE-2018-2404
SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation
8.8
CVE-2020-6292
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration
8.8
CVE-2020-6289
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site
8.8
CVE-2019-0258
SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges
8.8
CVE-2018-2413
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges