CVE-2020-6262: Code Injection
First published: Tue May 12 2020(Updated: )
Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Web Application Server | =740 | |
| SAP Web Application Server | =2008_1_46c | |
| SAP Web Application Server | =2008_1_620 | |
| SAP Web Application Server | =2008_1_640 | |
| SAP Web Application Server | =2008_1_700 | |
| SAP Web Application Server | =2008_1_710 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-6262?
CVE-2020-6262 is considered a critical vulnerability that allows code injection in the SAP Application Server ABAP.
How do I fix CVE-2020-6262?
To fix CVE-2020-6262, you should update your SAP Application Server ABAP to one of the patched versions listed in the SAP advisory.
Which versions are affected by CVE-2020-6262?
CVE-2020-6262 affects SAP Application Server ABAP versions prior to 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, and 740.
What are the potential impacts of CVE-2020-6262?
The potential impacts of CVE-2020-6262 include unauthorized code execution and control over the SAP application by an attacker.
Is there a workaround for CVE-2020-6262?
While the primary recommendation is to apply the update, temporary mitigation methods may involve restricting access to vulnerable functionalities.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sap
- canonical/sap web application server
- version/sap web application server/740
- version/sap web application server/2008_1_46c
- version/sap web application server/2008_1_620
- version/sap web application server/2008_1_640
- version/sap web application server/2008_1_700
- version/sap web application server/2008_1_710