SAP SE SAP NetWeaver AS JAVA (LM Configuration Wizard)
At a glance
- Source
- NVD
- EPSS
- EPSS 94.72 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Analyzed
Description
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
Weaknesses (CWE)
- CWE-306 — Missing Authentication for Critical Functionality
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
- https://launchpad.support.sap.com/#/notes/2934135
- https://www.onapsis.com/recon-sap-cyber-security-vulnerability
- http://seclists.org/fulldisclosure/2021/Apr/6
- http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | sap |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · cna@sap.com (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-27437
- GCVE · GCVE-0-2020-6287
CERT-FR advisories
- CERTFR-2020-AVI-495 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2020-AVI-432 — Multiples vulnérabilités dans SAP · cert.ssi.gouv.fr
- CERTFR-2020-ALE-017 — Multiples vulnérabilités dans SAP Netweaver AS JAVA · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:*cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP SE · SAP NetWeaver AS JAVA (LM Configuration Wizard) | affected < 7.30 ; affected < 7.31 ; affected < 7.40 ; affected < 7.50 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |