by Kastro
Paper/Archive/CVE-2020-6203

CVE-2020-6203

SAP SE SAP NetWeaver UDDI Server (Services Registry) — SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insuffic…

EPSS 2%CVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 79.2.792 × 2015.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs, leading to Path Traversal.

Affected

ProductAffectedFixed inSource
SAP NetWeaver UDDI Server (Services Registry)< 7.10–CNA
SAP NetWeaver UDDI Server (Services Registry)< 7.11–CNA
SAP NetWeaver UDDI Server (Services Registry)< 7.20–CNA
SAP NetWeaver UDDI Server (Services Registry)< 7.30–CNA
SAP NetWeaver UDDI Server (Services Registry)< 7.31–CNA
SAP NetWeaver UDDI Server (Services Registry)< 7.40–CNA
SAP NetWeaver UDDI Server (Services Registry)< 7.50–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
sap (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305reflaunchpad.support.sap.com/#/notes/2806198