CVE-2020-6249

The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.

Score

CVSS 3.1 8.8 High

Status

Modified - cna@sap.com

Published

2020-05-12

Last modified

2024-08-04

Weaknesses

CWE-89

Affected products

• Master Data Governance (s4core) (Sap)
• Master Data Governance (s4fnd) (Sap)
• Master Data Governance (sap Bs Fnd) (Sap)
• Sap Master Data Governance S4core (Sap Se)
• Sap Master Data Governance S4fnd (Sap Se)
• Sap Master Data Governance Sap Bs Fnd (Sap Se)

References

• https://launchpad.support.sap.com/#/notes/2908560
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222