Vulnerability · Published Jul 14, 2020 · Assigned by sap
CVE-2020-6286
Medium 5.3
In plain English
A medium-severity security flaw in SAP NetWeaver AS JAVA (LM Configuration Wizard) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 23.7% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.0)5.3Medium
Exploit odds (30 days)23.7%top 2.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver AS JAVA (LM Configuration Wizard) | < 7.30< 7.31< 7.40< 7.50 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2934135 x_refsource_MISC