CVE-2020-6287 | BDVDB-2026-138779 Detail
SAP SESAP NetWeaver AS JAVA (LM Configuration Wizard)
Description#
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
Impact#
Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-306 Missing Authentication for Critical Function
References#
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
- https://launchpad.support.sap.com/#/notes/2934135
- https://www.onapsis.com/recon-sap-cyber-security-vulnerability
- http://seclists.org/fulldisclosure/2021/Apr/6
- http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.