CVE-2020-6287

 

Published at: - 14-07-2020 03:15

Last modified: - 28-04-2022 08:57

Total changes: - 4

Description

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
• https://launchpad.support.sap.com/#/notes/2934135
• https://www.onapsis.com/recon-sap-cyber-security-vulnerability
• 20210405 Onapsis Security Advisory 2021-0003: [CVE-2020-6287] - [SAP RECON] SAP JAVA: Unauthenticated execution of configuration tasks-Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html

 

Keywords

NVD

 

CVE-2020-6287

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures