CVE-2020-6248

HIGH

7.2

Description

SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection.

CVE Details

CVSS v3.1 Score7.2

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published5/12/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

sap:adaptive_server_enterprise_backup_server

Weaknesses (CWE)

CWE-20CWE-94

References

https://launchpad.support.sap.com/#/notes/2917275(cna@sap.com)

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222(cna@sap.com)

https://launchpad.support.sap.com/#/notes/2917275(af854a3a-2127-422b-91ae-364da2661108)

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.