CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
YesDecision
Descriptions
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
SAP NetWeaver AS JAVA (LM Configuration Wizard), versiones 7.30, 7.31, 7.40, 7.50, no lleva a cabo una comprobación de autenticación que permite a un atacante sin autenticación previa ejecutar tareas de configuración para llevar a cabo acciones críticas contra el sistema SAP Java, incluyendo la capacidad para crear un usuario administrativo y, por lo tanto, comprometiendo la Confidencialidad, Integridad y la Disponibilidad del sistema, conllevando a una Falta de Comprobación de Autenticación
SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-08 CVE Reserved
- 2020-07-14 CVE Published
- 2020-07-21 First Exploit
- 2021-11-03 Exploited in Wild
- 2022-05-03 KEV Due Date
- 2024-08-04 CVE Updated
- 2024-09-08 EPSS Updated
CWE
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html | Third Party Advisory |
|
| http://seclists.org/fulldisclosure/2021/Apr/6 | Mailing List |
|
| https://www.onapsis.com/recon-sap-cyber-security-vulnerability | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/duc-nt/CVE-2020-6287-exploit | 2020-07-21 | |
| https://github.com/murataydemir/CVE-2020-6287 | 2020-09-18 | |
| https://github.com/ynsmroztas/CVE-2020-6287-Sap-Add-User | 2020-07-22 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 | 2022-04-28 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sap Search vendor "Sap" | Netweaver Application Server Java Search vendor "Sap" for product "Netweaver Application Server Java" | 7.30 Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.30" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Netweaver Application Server Java Search vendor "Sap" for product "Netweaver Application Server Java" | 7.31 Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.31" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Netweaver Application Server Java Search vendor "Sap" for product "Netweaver Application Server Java" | 7.40 Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.40" | - |
Affected
| ||||||
| Sap Search vendor "Sap" | Netweaver Application Server Java Search vendor "Sap" for product "Netweaver Application Server Java" | 7.50 Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.50" | - |
Affected
| ||||||