PT-2020-19058 · Sap · Sap Netweaver As Java

Published 2020-06-10 · Updated 2021-07-21 · CVE-2020-6263

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS Java versions 7.00 through 7.50

Description The issue affects standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol. These clients do not perform authentication checks for operations that require user identity, leading to an authentication bypass.

Recommendations For SAP NetWeaver AS Java versions 7.00 through 7.50, consider implementing additional authentication checks for operations that require user identity to prevent unauthorized access. As a temporary workaround, restrict access to sensitive operations until a proper fix is applied.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-6263

Affected Products

Sap Netweaver As Java

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6263 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6263 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2878568 · Note
• https://t.me/cvenotify/4286 · Telegram Post