CVE-2020-6236
First published: Tue Apr 14 2020(Updated: )
SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remotely. This results in the possibility to execute these files as root user from a non-root context, leading to Privilege Escalation.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Adaptive Extensions | =1.0 | |
| SAP Landscape Management | =3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-6236?
CVE-2020-6236 is a vulnerability in SAP Landscape Management version 3.0 and SAP Adaptive Extensions version 1.0 that allows an attacker with admin_group privileges to remotely change ownership and permissions of arbitrary files, potentially enabling the execution of these files as the root user.
What is the severity of CVE-2020-6236?
The severity of CVE-2020-6236 is high, with a CVSS score of 7.2.
What software versions are affected by CVE-2020-6236?
SAP Landscape Management version 3.0 and SAP Adaptive Extensions version 1.0 are affected by CVE-2020-6236.
How can an attacker exploit CVE-2020-6236?
An attacker with admin_group privileges can exploit CVE-2020-6236 by remotely changing ownership and permissions of arbitrary files, potentially enabling the execution of these files as the root user.
Are there any references for CVE-2020-6236?
Yes, you can find references for CVE-2020-6236 at the following links: [Reference 1](https://launchpad.support.sap.com/#/notes/2902456) and [Reference 2](https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202).
- collector/nvd-index
- agent/references
- agent/severity
- agent/type
- agent/event
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap adaptive extensions
- version/sap adaptive extensions/1.0
- canonical/sap landscape management
- version/sap landscape management/3.0