← Back to CVEs
CVE-2020-6287
CRITICALCISA KEV10.0
Description
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
CVE Details
CVSS v3.1 Score10.0
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published7/14/2020
Last Modified10/31/2025
Sourcekev
Honeypot Sightings0
CISA KEV
VendorSAP
ProductNetWeaver
Vulnerability NameSAP NetWeaver Missing Authentication for Critical Function Vulnerability
KEV Date Added2021-11-03
Remediation Due Date2022-05-03
Ransomware UseUnknown
Affected Products
sap:netweaver_application_server_java
Weaknesses (CWE)
CWE-306CWE-306
References
http://seclists.org/fulldisclosure/2021/Apr/6(cna@sap.com)
https://launchpad.support.sap.com/#/notes/2934135(cna@sap.com)
http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html(af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2021/Apr/6(af854a3a-2127-422b-91ae-364da2661108)
https://launchpad.support.sap.com/#/notes/2934135(af854a3a-2127-422b-91ae-364da2661108)
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675(af854a3a-2127-422b-91ae-364da2661108)
https://www.onapsis.com/recon-sap-cyber-security-vulnerability(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287(134c704f-9b21-4f2e-91b3-4a467353bcc0)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.