SAP · NetWeaver
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
What it is
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
CISA: SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- July 14, 2020
- Severity
- Critical 10.0 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- 95% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-306
- More details
- NVD · CVE.org · CISA
All references (5)
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
- https://launchpad.support.sap.com/#/notes/2934135
- https://www.onapsis.com/recon-sap-cyber-security-vulnerability
- http://seclists.org/fulldisclosure/2021/Apr/6
- http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html
More exploited flaws from SAP
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 15, 2025 | Deserialization | NetWeaver | Critical 9.1 | 13% |
| Apr 29, 2025 | Unrestricted File Upload | NetWeaver | Critical 10.0 | 99.5% |
| Mar 19, 2025 | Directory Traversal | NetWeaver | High 7.5 | 95% |
| Jun 9, 2022 | SQL Injection | NetWeaver | Critical 9.8 | 72% |
| Jun 9, 2022 | Information Disclosure | NetWeaver | Medium 5.3 | 52% |
| Jun 9, 2022 | Unrestricted File Upload | NetWeaver | Critical 9.9 | 37% |
| Nov 3, 2021 | Remote Code Execution | NetWeaver | Critical 10.0 | 18% |
| Nov 3, 2021 | Directory Traversal | NetWeaver | High 7.5 | 47% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.