by Kastro
Paper/Archive/CVE-2020-6263

CVE-2020-6263

SAP SE SAP NetWeaver AS JAVA — Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.9.739 × 2014.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass.

Affected

ProductAffectedFixed inSource
SAP NetWeaver AS JAVA< SAP-JEECOR 7.00–CNA
SAP NetWeaver AS JAVA< 7.01 SERVERCOR 7.10–CNA
SAP NetWeaver AS JAVA< 7.11–CNA
SAP NetWeaver AS JAVA< 7.20–CNA
SAP NetWeaver AS JAVA< 7.30–CNA
SAP NetWeaver AS JAVA< 7.31–CNA
SAP NetWeaver AS JAVA< 7.40–CNA
SAP NetWeaver AS JAVA< 7.50 CORE-TOOLS 7.00–CNA
SAP NetWeaver AS JAVA< 7.01–CNA
SAP NetWeaver AS JAVA< 7.02–CNA
SAP NetWeaver AS JAVA< 7.05–CNA
SAP NetWeaver AS JAVA< 7.10–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)6.9CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775reflaunchpad.support.sap.com/#/notes/2878568