CVE-2020-6318 Code injection in SAP NetWeaver (ABAP Server) and ABAP Platform

Critical 9.1 Published 9 Sep 2020 Updated 4 Aug 2024

Attackers can inject code into SAP NetWeaver ABAP Server to execute arbitrary commands, view or modify data, and cause service termination.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-6318?

CVE-2020-6318 is a critical code injection vulnerability in SAP NetWeaver (ABAP Server) and ABAP Platform, published on 9 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Because of this, an attacker can exploit these products via Code Injection, and potentially enabling to take complete control of the products, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the products to terminate.

Weakness: CWE-94

Which versions are affected by CVE-2020-6318?

It affects 1 product.

Products include Sap Abap Platform.

How do I fix CVE-2020-6318?

No fix has been published for CVE-2020-6318 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2020-6318 being exploited?

There is no known exploitation of CVE-2020-6318 in the wild and no public exploit code.

Sources

Also known as GHSA-rppr-4h7c-mc9c.