CVE-2020-6187 XML external entity in SAP NetWeaver (Guided Procedures)
An attacker with admin access can cause a Denial of Service in SAP NetWeaver Guided Procedures via insufficient XML validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6187?
CVE-2020-6187 is a medium-severity vulnerability in SAP NetWeaver (Guided Procedures), published on 12 Feb 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service.
Weakness: CWE-611
Which versions are affected by CVE-2020-6187?
It affects 1 product.
Products include Sap Netweaver Guided Procedures.
How do I fix CVE-2020-6187?
No fix has been published for CVE-2020-6187 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6187 being exploited?
There is no known exploitation of CVE-2020-6187 in the wild and no public exploit code.
Other vulnerabilities in SAP NetWeaver (Guided Procedures)
Sources
Also known as GHSA-x3g8-jv8c-3mvc.