CVE-2020-6203: SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information…

Description

SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs, leading to Path Traversal.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.9% · higher than 79% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

NE

Netweaver · Sap

7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more · source: NVD