Vulnerability Report

CVE-2020-6287

CISA KEV Active

Title: Sap Netweaver Application Server Java Auth Bypass

Auth Bypass

Proof Of Concept

PoC Available for CVE-2020-6287

CWE Category CWE-306
Published Date Jul 14, 2020
Modified Date Oct 31, 2025
Exploit Status Available
Score 10.0 CVSS v3.1
Exploit Probability (EPSS)
94.39%

Vulnerability Summary

CVE-2020-6287: SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

Impacted Vendors

S
sap 1

Reference Links

http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html http://seclists.org/fulldisclosure/2021/Apr/6 https://launchpad.support.sap.com/#/notes/2934135 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 https://www.onapsis.com/recon-sap-cyber-security-vulnerability http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html http://seclists.org/fulldisclosure/2021/Apr/6 https://launchpad.support.sap.com/#/notes/2934135 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 https://www.onapsis.com/recon-sap-cyber-security-vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
10.0
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v3.0
Source Entity [email protected]
Severity CRITICAL
10.0
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v2.0
Source Entity [email protected]
Severity HIGH
10.0
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2020-6287 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/chipik/SAP_RECON
View Code
GitHub https://github.com/duc-nt/CVE-2020-6287-exploit
View Code
GitHub https://github.com/murataydemir/CVE-2020-6287
View Code
MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.