CVE-2020-6204: SAP Treasury And Risk Management (ea-Finserv)

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.

Affected products

• SAP Treasury And Risk Management (ea-Finserv): version 600 only; version 603 only; version 604 only; version 605 only; version 606 only; version 616 only; …
• SAP Treasury And Risk Management (s4core): version 101 only; version 102 only; version 103 only; version 104 only

Published 2020-03-10. Last modified 2026-06-17.