PT-2020-19039 · Sap · Sap Adaptive Server Enterprise

Published 2020-05-12 · Updated 2021-07-21 · CVE-2020-6243

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Adaptive Server Enterprise versions 15.7, 16.0

Description The issue allows an attacker to read, modify, or delete restricted data on connected servers due to insufficient checks for authenticated users when executing an extended stored procedure, potentially leading to code injection.

Recommendations For versions 15.7 and 16.0, consider restricting access to the extended stored procedure until a patch is available. As a temporary workaround, limit the privileges of authenticated users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-6243

Affected Products

Sap Adaptive Server Enterprise

References · 5

• https://osv.dev/vulnerability/CVE-2020-6243 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6243 · Security Note
• https://t.me/cvenotify/3714 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2915585 · Note