SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2021/Apr/6 | Mailing List Third Party Advisory |
| https://launchpad.support.sap.com/#/notes/2934135 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 | Vendor Advisory |
| https://www.onapsis.com/recon-sap-cyber-security-vulnerability | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
28 Apr 2022, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-306 | |
| References | (MISC) http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html - Third Party Advisory, VDB Entry | |
| References | (MISC) https://www.onapsis.com/recon-sap-cyber-security-vulnerability - Third Party Advisory | |
| References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Apr/6 - Mailing List, Third Party Advisory |
06 Apr 2021, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Apr 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2020-07-14 13:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-6287
Mitre link : CVE-2020-6287
CVE.ORG link : CVE-2020-6287
JSON object : View
Products Affected
sap
- netweaver_application_server_java
CWE
CWE-306
Missing Authentication for Critical Function