Critical severity · published Jul 14, 2020
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
In wildKEV
10.0
CVSS
94.7%
EPSS
Yes
On KEV
Description
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)94.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS JAVA (LM Configuration Wizard) · SAP SE
< 7.30; < 7.31; < 7.40; < 7.50 · source: vendor
NA
Netweaver Application Server Java · Sap
7.30; 7.31; 7.40; 7.50 · source: NVD
NE
NetWeaver · SAP
All versions, or not specified · source: KEV
Affected product
SN
SAP NetWeaver AS JAVA (LM Configuration Wizard)
SAP SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6287
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6287
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2934135
x_refsource_MISC
https://www.onapsis.com/recon-sap-cyber-security-vulnerability
mailing-list
http://seclists.org/fulldisclosure/2021/Apr/6
x_refsource_MISC
http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html