CVE-2020-6259

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted leading to Missing Authorization Check.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP SE	SAP Adaptive Server Enterprise	< 15.7; < 16.0

References

https://launchpad.support.sap.com/#/notes/2920548Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Vendor Advisory
https://launchpad.support.sap.com/#/notes/2920548Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Vendor Advisory

Timeline

Published: May 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-62605.3SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, CVE-2020-62615.3SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XM CVE-2020-62628.8Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740 CVE-2020-62639.8Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7 CVE-2020-62647.5SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise b CVE-2020-62659.8SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass CVE-2020-62665.4SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL v CVE-2020-62675.4Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only CVE-2020-62688.1Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE version CVE-2020-62696.5Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which wo CVE-2020-62706.5SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary autho CVE-2020-62718.2SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume