Back to overview

CVE-2020-6287

CRITICAL KEV CISA Exploitation: ACTIVE
10.0
CVSS 3.0
Description
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

Metadata

CVE ID
CVE-2020-6287
State
PUBLISHED
Assigner
sap
Reserved
2020-01-08 00:00 UTC
Published
2020-07-14 12:30 UTC
Last updated
2025-10-21 23:35 UTC
Primary CWE
CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product
SAP SE / SAP NetWeaver AS JAVA (LM Configuration Wizard)
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
yes
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
Vendor
SAP
Product
NetWeaver
Added to KEV
2021-11-03
Due date
2022-05-03
Ransomware
Not known
Required action
Apply updates per vendor instructions.
CISA description
SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
Affected products (1)
VendorProductPlatformVersions
SAP SE SAP NetWeaver AS JAVA (LM Configuration Wizard) — < 7.30, < 7.31, < 7.40, < 7.50
Weakness (CWE)
CWESourceDescription
— cna Missing Authentication Check
CWE-306 adp CWE-306 Missing Authentication for Critical Function
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.0 cna CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (5)
Back to overview