CVE-2020-6280 Information disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform
An attacker with admin privileges can access restricted files in SAP NetWeaver, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6280?
CVE-2020-6280 is a low-severity vulnerability in Sap Netweaver Application Server Abap, published on 14 Jul 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure.
Which versions are affected by CVE-2020-6280?
It affects 2 products.
Products include Sap Abap Platform, Sap Netweaver Application Server Abap.
How do I fix CVE-2020-6280?
No fix has been published for CVE-2020-6280 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6280 being exploited?
There is no known exploitation of CVE-2020-6280 in the wild and no public exploit code.
Other vulnerabilities in Sap Netweaver Application Server Abap
- CVE-2021-44231 Code injection in SAP ABAP Server & ABAP Platform (Translation Tools)
- CVE-2024-22131 Code Injection vulnerability in SAP ABA (Application Basis)
- CVE-2020-6318 Code injection in SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2020-6296 Code injection in SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2023-25615 SQL Injection vulnerability in SAP ABAP Platform
Sources
Also known as GHSA-x67h-jqrj-8587.