CVSS: 5.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-6282
https://notcve.org/view.php?id=CVE-2020-6282
SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. SAP NetWeaver AS JAVA (servicio IIOP) (SERVERCORE), versiones 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, y SAP NetWeaver AS JAVA (servicio IIOP) (CORE-TOOLS), versiones 7.10, 7.11, 7.20, 7.30 , 7.31, 7.40, 7.50, permite a un atacante enviar una petición diseñada desde una aplicación web vulnerable. Normalmente es usada para apuntar a sistemas internos detrás de los firewalls que normalmente son inaccesibles a un atacante desde la red externa, resultando en una vulnerabilidad de tipo Server-Side Request Forgery • https://launchpad.support.sap.com/#/notes/2896025 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-6263
https://notcve.org/view.php?id=CVE-2020-6263
Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass. Los clientes dedicados que se conectan a SAP NetWeaver AS Java por medio del protocolo P4, versiones (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11 , 7.20, 7.30, 7.31, 7.40, 7.50), no realiza ninguna comprobación de autenticación para las operaciones que requieren identidad del usuario conllevando a una Omisión de Autenticación • https://launchpad.support.sap.com/#/notes/2878568 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.2EPSS: 0%CPEs: 7EXPL: 0CVE-2020-6224
https://notcve.org/view.php?id=CVE-2020-6224
SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure. SAP NetWeaver AS Java (HTTP Service), versiones 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permite a un atacante con privilegios de administrador acceder a datos confidenciales del usuario, tales como contraseñas en archivos de rastreo, cuando el usuario inicia sesión y envía una petición con credenciales de inicio de sesión, conllevando a una Divulgación de Información. • https://launchpad.support.sap.com/#/notes/2826528 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6202
https://notcve.org/view.php?id=CVE-2020-6202
SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source configuration XML document accepted from an untrusted source, leading to Missing XML Validation. SAP NetWeaver Application Server Java (User Management Engine), versiones 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; no comprueba suficientemente el documento XML de configuración de la fuente de datos LDAP aceptado desde una fuente no segura , conllevando a una Falta de Comprobación XML. • https://launchpad.support.sap.com/#/notes/2847787 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-0391
https://notcve.org/view.php?id=CVE-2019-0391
Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted. Bajo determinadas condiciones, SAP NetWeaver AS Java (corregido en versiones 7.10, 7.20, 7.30, 7.31, 7.40, 7.50), permite a un atacante acceder a información que de otro modo estaría restringida. • https://launchpad.support.sap.com/#/notes/2835226 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 •