SAP SE SAP Disclosure Management
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2020-6292 | < 1.0 | Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session | HIGH 8.8 | 0.6 % | ||
| CVE-2020-6291 | < 1.0 | SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authent | HIGH 8.8 | 0.6 % | ||
| CVE-2020-6290 | < 1.0 | SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specifi | MEDIUM 6.3 | 0.6 % | ||
| CVE-2020-6289 | < 1.0 | SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user i | HIGH 8.8 | 0.4 % | ||
| CVE-2020-6267 | < 10.1 | Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only | MEDIUM 6.3 | 0.8 % | ||
| CVE-2020-6209 | < 10.1 | SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to admin | HIGH 7.5 | 0.8 % | ||
| CVE-2020-6303 | < 10.1 | SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. | MEDIUM 5.4 | 0.5 % | ||
| CVE-2019-0258 | < 10.01 | SAP Disclosure Management, version 10.01, does not perform necessary authorization checks for an authenticated user, resulting in escalation | HIGH 8.8 | 1.4 % | ||
| CVE-2019-0254 | < 10.1 Stack 1301 | SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scri | MEDIUM 5.4 | 0.9 % | ||
| CVE-2018-2413 | 10.1 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile | HIGH 8.8 | 1.4 % | ||
| CVE-2018-2412 | 10.1 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privile | HIGH 8.8 | 1.4 % | ||
| CVE-2018-2404 | 10.1 | SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. | CRITICAL 9.8 | 1.8 % | ||
| CVE-2018-2403 | 10.1 | Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is | MEDIUM 6.5 | 1.1 % |