← Zuruck zu CVEs
CVE-2020-6287
CRITICALCISA KEV10.0
Beschreibung
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
CVE Details
CVSS v3.1 Bewertung10.0
SchweregradCRITICAL
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht7/14/2020
Zuletzt geandert10/31/2025
Quellekev
Honeypot-Sichtungen0
CISA KEV
HerstellerSAP
ProduktNetWeaver
SchwachstellennameSAP NetWeaver Missing Authentication for Critical Function Vulnerability
KEV Aufnahmedatum2021-11-03
Behebungsfrist2022-05-03
Ransomware-NutzungUnknown
Betroffene Produkte
sap:netweaver_application_server_java
Schwachen (CWE)
CWE-306CWE-306
Referenzen
http://seclists.org/fulldisclosure/2021/Apr/6(cna@sap.com)
https://launchpad.support.sap.com/#/notes/2934135(cna@sap.com)
http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html(af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2021/Apr/6(af854a3a-2127-422b-91ae-364da2661108)
https://launchpad.support.sap.com/#/notes/2934135(af854a3a-2127-422b-91ae-364da2661108)
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675(af854a3a-2127-422b-91ae-364da2661108)
https://www.onapsis.com/recon-sap-cyber-security-vulnerability(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287(134c704f-9b21-4f2e-91b3-4a467353bcc0)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.