CVE-2020-6287

SAP NetWeaver AS JAVA (LM Configuration Wizard), versiones 7.30, 7.31, 7.40, 7.50, no lleva a cabo una comprobación de autenticación que permite a un atacante sin autenticación previa ejecutar tareas de configuración para llevar a cabo acciones críticas contra el sistema SAP Java, incluyendo la capacidad para crear un usuario administrativo y, por lo tanto, comprometiendo la Confidencialidad, Integridad y la Disponibilidad del sistema, conllevando a una Falta de Comprobación de Autenticación

A malicious unauthenticated user could abuse the lack of authentication check on a particular web service exposed by default in SAP Netweaver JAVA stack, allowing them to fully compromise the targeted system. Affected components include SAP Netweaver JAVA versions 7.30 through 7.50 and LM CONFIGURATION WIZARD versions 7.30 SP019 Patch 0000, 7.30 SP020 Patch 0000, 7.31 SP023 Patch 0000, 7.31 SP024 Patch 0000, 7.31 SP025 Patch 0000, 7.31 SP026 Patch 0000, 7.40 SP018 Patch 0000, 7.40 SP019 Patch 0000, 7.40 SP020 Patch 0000, 7.40 SP021 Patch 0000, 7.50 SP012 Patch 0001 and lower, 7.50 SP013 Patch 0002 and lower, 7.50 SP014 Patch 0001 and lower, 7.50 SP015 Patch 0001 and lower, 7.50 SP016 Patch 0001 and lower, 7.50 SP017 Patch 0001 and lower, and 7.50 SP018 Patch 0000.

SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.