CVE-2020-6287

Summary

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

Affected Software

Weaknesses

• Missing Authentication Check

ADP Enrichment

CVE Program Container

Additional References

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
• https://launchpad.support.sap.com/#/notes/2934135
• https://www.onapsis.com/recon-sap-cyber-security-vulnerability
• http://seclists.org/fulldisclosure/2021/Apr/6
• http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: active
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287

References

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
• https://launchpad.support.sap.com/#/notes/2934135
• https://www.onapsis.com/recon-sap-cyber-security-vulnerability
• http://seclists.org/fulldisclosure/2021/Apr/6
• http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html

• ←Previous
• Next→