BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2020-6287SAP NetWeaver Missing Authentication for Critical Function Vulnerability

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

10.0 CRITICALEPSS 94.71%⚡ Known Exploited (CISA KEV)NVD: Analyzed

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
10.0CRITICAL3.1NVDCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0CRITICAL3.0sap (CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0HIGH2.0NVDAV:N/AC:L/Au:N/C:C/I:C/A:C

CISA required action

⚡ Known exploited · remediation due May 3, 2022

Apply updates per vendor instructions.

Details

CVE ID
CVE-2020-6287
Status
Analyzed
Assigner (CNA)
sap
Published
Jul 14, 2020
Last modified
2026-06-17 03:23 UTC
Weaknesses

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:58 UTC.