CVE-2020-6310 Information disclosure in SAP NetWeaver (ABAP Server) and ABAP Platform
Authenticated users can enumerate all SAP users via improper access control in the SOA Configuration Trace component, exposing sensitive user data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6310?
CVE-2020-6310 is a medium-severity vulnerability in Sap Netweaver Application Server Abap, published on 12 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure.
Which versions are affected by CVE-2020-6310?
It affects 2 products.
Products include Sap Abap Platform, Sap Netweaver Application Server Abap.
How do I fix CVE-2020-6310?
No fix has been published for CVE-2020-6310 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6310 being exploited?
There is no known exploitation of CVE-2020-6310 in the wild and no public exploit code.
Other vulnerabilities in Sap Netweaver Application Server Abap
- CVE-2021-44231 Code injection in SAP ABAP Server & ABAP Platform (Translation Tools)
- CVE-2024-22131 Code Injection vulnerability in SAP ABA (Application Basis)
- CVE-2020-6318 Code injection in SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2020-6296 Code injection in SAP NetWeaver (ABAP Server) and ABAP Platform
- CVE-2023-25615 SQL Injection vulnerability in SAP ABAP Platform
Sources
Also known as GHSA-cvcj-pj4r-5rm5.