PT-2020-19092 · Sap · Abap Platform+2

Published 2020-09-09 · Updated 2022-07-01 · CVE-2020-6318

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver (ABAP Server) versions up to 7.40 ABAP Platform versions greater than 7.40

Description A Remote Code Execution issue exists, allowing an attacker to exploit the products via Code Injection. This can enable the attacker to take complete control of the products, including viewing, changing, or deleting data by injecting code into the working memory, which is subsequently executed by the application. It can also cause a general fault in the product, leading to termination.

Recommendations For SAP NetWeaver (ABAP Server) versions up to 7.40, update to a version above 7.40 to mitigate the risk. For ABAP Platform versions greater than 7.40, consider restricting access to sensitive areas of the application until a patch is available. As a temporary workaround, consider disabling code injection capabilities in the affected products until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-6318

Affected Products

Abap Platform

Abap Server

Sap Netweaver

References · 6

• 🔥 http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2022/May/42 · Exploit
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6318 · Security Note
• https://launchpad.support.sap.com/#/notes/2958563 · Note