CVE-2020-6298 : Security Advisory and Response

SAP Banking Services (Generic Market Data) versions 400, 450, and 500 are affected by a vulnerability that allows unauthorized users to access and modify protected Business Partner Generic Market Data (GMD) due to a Missing Authorization Check.

Understanding CVE-2020-6298

SAP Banking Services (Generic Market Data) vulnerability with a high severity score.

What is CVE-2020-6298?

The vulnerability in SAP Banking Services (Generic Market Data) versions 400, 450, and 500 enables unauthorized users to view and alter protected GMD and related key figure values due to a lack of proper authorization checks.

The Impact of CVE-2020-6298

The vulnerability has a high severity level, affecting confidentiality, integrity, and availability of the system.

Technical Details of CVE-2020-6298

Details on the vulnerability in SAP Banking Services.

Vulnerability Description

The issue arises from a Missing Authorization Check in the affected versions of SAP Banking Services (Generic Market Data).

Affected Systems and Versions

Product: SAP Banking Services (Generic Market Data)
Vendor: SAP SE
Vulnerable Versions: < 400, < 450, < 500

Exploitation Mechanism

Unauthorized users can exploit the vulnerability to access and modify protected GMD and related key figure values.

Mitigation and Prevention

Steps to address and prevent the CVE-2020-6298 vulnerability.

Immediate Steps to Take

Apply security patches provided by SAP.
Restrict access to sensitive GMD data.
Monitor and audit user activities for unauthorized access.

Long-Term Security Practices

Regularly update and patch SAP Banking Services.
Implement least privilege access controls.
Conduct security training for employees handling GMD data.

Patching and Updates

Ensure timely installation of security patches and updates for SAP Banking Services.