CVE-2020-6287: SAP NetWeaver Missing Authentication for Critical Function Vulnerability
First published: Tue Jul 14 2020(Updated: )
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver Application Server Java | =7.30 | |
| SAP NetWeaver Application Server Java | =7.31 | |
| SAP NetWeaver Application Server Java | =7.40 | |
| SAP NetWeaver Application Server Java | =7.50 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html
- http://seclists.org/fulldisclosure/2021/Apr/6
- https://launchpad.support.sap.com/#/notes/2934135
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
- https://www.onapsis.com/recon-sap-cyber-security-vulnerability
Frequently Asked Questions
What is the vulnerability ID of this SAP NetWeaver vulnerability?
The vulnerability ID is CVE-2020-6287.
What is the title of this SAP NetWeaver vulnerability?
The title of this vulnerability is SAP NetWeaver Missing Authentication for Critical Function Vulnerability.
What is the severity of CVE-2020-6287?
The severity of CVE-2020-6287 is critical.
Which versions of SAP NetWeaver AS JAVA are affected by this vulnerability?
SAP NetWeaver AS JAVA versions 7.30, 7.31, 7.40, and 7.50 are affected by this vulnerability.
How does this vulnerability impact the SAP Java system?
This vulnerability allows an attacker without prior authentication to execute configuration tasks and perform critical actions against the SAP Java system, including the ability to create a...
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- collector/nvd-index
- vendor/sap
- canonical/sap netweaver
- canonical/sap netweaver application server java
- version/sap netweaver application server java/7.30
- version/sap netweaver application server java/7.31
- version/sap netweaver application server java/7.40
- version/sap netweaver application server java/7.50