Vulnerability record · CVE-2020-6199 · published 10 March 2020

CVE-2020-6199: Sap erp missing authorization vulnerability

Sap · Erp

The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization Check.

5.4 CVSS 3.1 Medium EPSS 0.33% · top 75.8% CWE-862 · Missing authorization

5.4CVSS 3.1 base score, v2 5.5

0.33%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Erp Sap

References

Link	Tags
https://launchpad.support.sap.com/#/notes/2871167	Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305	Vendor Advisory
https://launchpad.support.sap.com/#/notes/2871167	Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305	Vendor Advisory

Track CVE-2020-6199 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2020-6188Sap erp missing authorization vulnerabilityVAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (…EPSS 0.68%12 Feb 2020 6.1CVE-2026-24323Sap document management system open redirect vulnerabilityThe BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sa…EPSS 0.21%10 Feb 2026 6.1CVE-2026-0505Sap document management system cross-site scripting vulnerabilityThe BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could resul…EPSS 0.22%10 Feb 2026 5.4CVE-2020-6212Sap erp missing authorization vulnerabilityEgypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and…EPSS 0.65%24 Apr 2020 4.3CVE-2020-6316Sap erp missing authorization vulnerabilitySAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Mis…EPSS 0.82%10 Nov 2020 9.9CVE-2026-84869ScreenConnect client allows unauthorized file transfer and execution in remote sessionsA flaw in the ConnectWise ScreenConnect client lets files be transferred and executed inside an active remote session without authorization or Host c…KEVEPSS 0.92%analysed8 Sep 2026 7.8CVE-2022-0492Linux kernel cgroups v1 release_agent privilege escalation and container escapeThe Linux kernel's cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c mishandles authorization, letting the cgroups v1 release_agent feature be …KEVEPSS 5.5%analysed3 Mar 2022 9.9CVE-2024-57726SimpleHelp missing authorization lets low-privilege technicians escalate to adminSimpleHelp remote support software v5.5.7 and earlier fails to properly authorize API key creation, allowing low-privilege technicians to mint API ke…KEVEPSS 67%analysed15 Jan 2025

Source: NIST National Vulnerability Database (record CVE-2020-6199), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.