CVE-2020-6287 SAP NetWeaver Missing Authentication for Critical Function
Unauthenticated attackers can execute configuration tasks and create administrative users in SAP NetWeaver AS JAVA, leading to full system compromise.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6287?
CVE-2020-6287 is a critical missing authorization vulnerability in Sap Netweaver Application Server Java, published on 14 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
Weakness: CWE-306
Which versions are affected by CVE-2020-6287?
It affects 1 product.
Products include Sap Netweaver Application Server Java.
How do I fix CVE-2020-6287?
No fix has been published for CVE-2020-6287 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-6287 being exploited?
Yes. Attackers have exploited CVE-2020-6287 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 7 proofs of concept on GitHub.
Other vulnerabilities in Sap Netweaver Application Server Java
Sources
Also known as GHSA-676j-vqr4-6w3h.