CVE-2020-6287
- State
- Published
- Severity
- 10.0 Critical
- Published
- Jul 14, 2020
- Updated
- Oct 21, 2025
- Reserved
- Jan 8, 2020
Description
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 10.0 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | sap |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
SAP NetWeaver AS JAVA (LM Configuration Wizard)SAP SE |
|
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
- https://launchpad.support.sap.com/#/notes/2934135
- https://www.onapsis.com/recon-sap-cyber-security-vulnerability
- 20210405 Onapsis Security Advisory 2021-0003: [CVE-2020-6287] - [SAP RECON] SAP JAVA: Unauthenticated execution of configuration tasksmailing-list
- http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.