CVE-2020-6287 — CRITICAL (10.0)

Vulnerability Description

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Sap	Netweaver Application Server Java	7.30

Related Weaknesses (CWE)

CWE-306

References

http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-ExecutioThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2021/Apr/6Mailing ListThird Party Advisory
https://launchpad.support.sap.com/#/notes/2934135Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675Broken LinkVendor Advisory
https://www.onapsis.com/recon-sap-cyber-security-vulnerabilityThird Party Advisory
http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-ExecutioThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2021/Apr/6Mailing ListThird Party Advisory
https://launchpad.support.sap.com/#/notes/2934135Permissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675Broken LinkVendor Advisory
https://www.onapsis.com/recon-sap-cyber-security-vulnerabilityThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-US Government Resource

FAQ

What is CVE-2020-6287?

CVE-2020-6287 is a vulnerability with a CVSS score of 10.0 (CRITICAL). SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configurat...

How severe is CVE-2020-6287?

CVE-2020-6287 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-6287?

Check the references section above for vendor advisories and patch information. Affected products include: Sap Netweaver Application Server Java.