PT-2020-5170 · Sap · Sap Netweaver

Published 2020-08-12 · Updated 2022-10-05 · CVE-2020-6299

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver (ABAP Server) and ABAP Platform versions 740, 750, 751, 752, 753, 754, 755

Description The issue allows a business user to access the list of users in the given system using value help, leading to Information Disclosure. It is related to the lack of protection of service data in the SAP NetWeaver platform. Exploitation of the issue may allow a remote attacker to obtain access to the list of users in the system with the help of value help.

Recommendations For versions 740, 750, 751, 752, 753, 754, 755, consider restricting access to the value help feature to minimize the risk of information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-05781

CVE-2020-6299

Affected Products

Sap Netweaver

References · 5

• https://bdu.fstec.ru/vul/2020-05781 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6299 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6299 · Security Note
• https://launchpad.support.sap.com/#/notes/2941510 · Note