CVE-2020-6248 Code injection in SAP Adaptive Server Enterprise (Backup Server)
An authenticated user can execute arbitrary code via DUMP or LOAD commands in SAP Adaptive Server Enterprise Backup Server due to insufficient validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6248?
CVE-2020-6248 is a critical code injection vulnerability in SAP Adaptive Server Enterprise (Backup Server), published on 12 May 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection.
Which versions are affected by CVE-2020-6248?
It affects 1 product.
Products include Sap Adaptive Server Enterprise Backup Server.
How do I fix CVE-2020-6248?
No fix has been published for CVE-2020-6248 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-6248 being exploited?
There is no known exploitation of CVE-2020-6248 in the wild and no public exploit code.
Sources
Also known as GHSA-c2qp-x363-pmpr.