PT-2020-19023 · Sap · Sap Netweaver

Published 2020-04-14 · Updated 2020-04-15 · CVE-2020-6225

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP NetWeaver (Knowledge Management) versions 7.00 through 7.50

Description The issue arises from insufficient validation of path information provided by users, allowing characters that represent a traverse to the parent directory to be passed through to the file APIs. This enables an attacker to overwrite, delete, or corrupt arbitrary files on the remote server, resulting in a path traversal issue.

Recommendations For versions 7.00 through 7.50, update to a version that includes the fix for this issue to prevent path traversal attacks.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-6225

Affected Products

Sap Netweaver

References · 4

• https://launchpad.support.sap.com/#/notes/2896682 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6225 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 · Vendor Advisory