Vulnerability · Published Aug 12, 2020 · Assigned by sap
CVE-2020-6293
High 7.3
In plain English
A high-severity security flaw in SAP NetWeaver (Knowledge Management) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.0)7.3High
Exploit odds (30 days)0.9%top 39.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access control lists and other upload file size restrictions, leading to Unrestricted File Upload.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver (Knowledge Management) | < 7.30< 7.31< 7.40< 7.50 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2938162 x_refsource_MISC