PT-2020-18993 · Sap · Sap Netweaver As Java

Published 2020-02-12 · Updated 2020-02-19 · CVE-2020-6190

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java (Heap Dump Application) versions 7.30, 7.31, 7.40, 7.50

Description The issue allows attackers to gain valuable information about the system, including hostname, server node, and installation path, through certain vulnerable endpoints. This information could be misused, leading to information disclosure.

Recommendations For versions 7.30, 7.31, 7.40, 7.50, consider restricting access to the vulnerable endpoints in the Heap Dump Application to minimize the risk of exploitation. As a temporary workaround, avoid using the vulnerable Heap Dump Application until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-6190

Affected Products

Sap Netweaver As Java

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-6190 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6190 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2838835 · Vendor Advisory
• https://t.me/cvenotify/962 · Telegram Post