Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

CVE-2020-6287

🗓️ 14 Jul 2020 12:30:14Reported by sapType 
cve
 cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 1383 Views🌐 WEB

SAP NetWeaver AS JAVA allows unauthenticated attackers to execute configuration task

Related
Detection
Affected
Refs
Paths
Social
ReporterTitlePublishedViews
Family
gitee
Gitee		Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java
27 Nov 202020:06
–gitee
githubexploit
GithubExploit		Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java
21 Jul 202001:22
–githubexploit
githubexploit
GithubExploit		Exploit for Path Traversal in Sap Netweaver_Application_Server_Java
15 Jul 202015:20
–githubexploit
githubexploit
GithubExploit		Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java
20 Jul 202018:45
–githubexploit
ics
ICS		Critical Vulnerability in SAP NetWeaver AS Java
13 Jul 202012:00
–ics
attackerkb
attackerkb		CVE-2020-6287: Critical Vulnerability in SAP NetWeaver Application Server (AS) Java
14 Jul 202013:15
–attackerkb
avleonov
Information Security Automation		Barapass, Tsunami scanner, vulnerabilities in Windows DNS Server and SAP products, weird attack on Twitter
18 Jul 202018:31
–avleonov
bdu_fstec
BDU FSTEC		The vulnerability of SAP NetWeaver Java Application Server, a software integration platform of SAP NetWeaver, related to authentication errors, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
21 Apr 202100:00
–bdu_fstec
circl
Circl		CVE-2020-6287
14 Jul 202008:44
–circl
cisa_kev
CISA KEV Catalog		SAP NetWeaver Missing Authentication for Critical Function Vulnerability
3 Nov 202100:00
–cisa_kev
Rows per page
[
  {
    "product": "SAP NetWeaver AS JAVA (LM Configuration Wizard)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.30"
      },
      {
        "status": "affected",
        "version": "< 7.31"
      },
      {
        "status": "affected",
        "version": "< 7.40"
      },
      {
        "status": "affected",
        "version": "< 7.50"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
USERNAMErequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306
PASSWORDrequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306
ROLErequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306
PCKUser/userNamerequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306
PCKUser/passwordrequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306
SAP_XI_PCK_CONFIG/roleNamerequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306
SAP_XI_PCK_COMMUNICATION/roleNamerequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306
SAP_XI_PCK_MONITOR/roleNamerequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306
SAP_XI_PCK_ADMIN/roleNamerequest body/CTCWebService/CTCWebServiceBeanUnauthenticated web service allows creation of a user with a specified role via SOAP, enabling privilege escalation on SAP NetWeaver AS Java LM Configuration Wizard.CWE-306

Couple of new #SIGMA rules to cover exploitation of CVE-2020-6287 / #CVE-2020-6207 SAP #vulnerabilities. (processes behaviour / #SAP audit events based). Available on #TDM. [Ref]: https://t.co/ggddxOezYB?amp=1 [RULES]: https://t.co/OXw4VMSTc0?amp=1 #threathunting #SOC #blueteam

CVE-2020-6287 PoC https://t.co/TfnmZFkvEg?amp=1 #infosec

CVE-2020-6287 PoC https://t.co/TfnmZFkvEg?amp=1 #infosec

"The attacks are brute-forcing high-privilege SAP user accounts, as well as exploiting a raft of known bugs: CVE-2020-6287, CVE-2020-6207, CVE-2018-2380, CVE-2016-9563, CVE-2016-3976 and CVE-2010-5326" #infosec #CyberSecurity

[PDF] ONAPSIS: Active Cyberattacks on Mission-Critical SAP Applications - CVE-2020-6287, CVE-2020-6207, CVE-2018-2380, CVE-2016-9563, CVE-2016-3976 and CVE-2010-5326 https://t.co/XfCxK9iohL?amp=1 #security #threathunting #infosec

CVE-2020-6287 Critical Vulnerability in SAP NetWeaver AS Java. The vulne... https://t.co/Qr1l3g8ROw?amp=1 Don't wait vulnerability scanning results: https://t.co/oh1APvMMnd?amp=1

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 03:23Current
10Critical risk
Vulners AI Score10
CVSS 3.110
CVSS 210
CVSS 310
EPSS0.94719
SSVC
CWE-306In Wild
sapnetweaveras javacve-2020-6287security vulnerabilityauthentication checkconfiguration tasksnvd
1383