CVE-2020-6249

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an attacker to execute crafted database queries, exposing the backend database, leading to SQL Injection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SAP SE	SAP Master Data Governance (S4CORE)	< 101
SAP SE	SAP Master Data Governance (S4FND)	< 102; < 103; < 104
SAP SE	SAP Master Data Governance (SAP_BS_FND)	< 748

References

https://launchpad.support.sap.com/#/notes/2908560Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Vendor Advisory
https://launchpad.support.sap.com/#/notes/2908560Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Vendor Advisory

Timeline

Published: May 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-62506.8SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the a CVE-2020-62516.5Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access i CVE-2020-62528.0Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sen CVE-2020-62537.2Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafte CVE-2020-62546.1SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payloa CVE-2020-62564.3SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details with CVE-2020-62575.4SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resultin CVE-2020-62586.5SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to vi CVE-2020-62596.5Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise CVE-2020-62605.3SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, CVE-2020-62615.3SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XM CVE-2020-62628.8Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740