Vulnerability Description
SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Netweaver Application Server Abap | 700 |
Related Weaknesses (CWE)
References
- https://launchpad.support.sap.com/#/notes/2912939Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2912939Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775Vendor Advisory
FAQ
What is CVE-2020-6275?
CVE-2020-6275 is a vulnerability with a CVSS score of 9.8 (CRITICAL). SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path n...
How severe is CVE-2020-6275?
CVE-2020-6275 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-6275?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Netweaver Application Server Abap.