Log in Start free

Actively exploited · Published Jul 14, 2020 · Assigned by sap

CVE-2020-6287

Critical 10.0 Exploited

In plain English

A critical-severity missing authentication in SAP NetWeaver AS JAVA (LM Configuration Wizard) from SAP SE. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 94.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.0)10.0Critical
Exploit odds (30 days)94.7%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

Affected products (as reported)

VendorProductVersions
SAP SE SAP NetWeaver AS JAVA (LM Configuration Wizard) < 7.30< 7.31< 7.40< 7.50

Weakness: CWE-306 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References