CVE-2020-6287

🗓️ 14 Jul 2020 12:30:14Reported by sapType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 1390 Views🌐 WEB

SAP NetWeaver AS JAVA allows unauthenticated attackers to execute configuration task

Reporter	Title	Published	Views	Family All 49
Gitee	Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java	27 Nov 202020:06	–	gitee
GithubExploit	Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java	13 Aug 202009:12	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java	21 Jul 202001:22	–	githubexploit
GithubExploit	Exploit for Path Traversal in Sap Netweaver_Application_Server_Java	15 Jul 202015:20	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java	20 Jul 202018:45	–	githubexploit
ICS	Critical Vulnerability in SAP NetWeaver AS Java	13 Jul 202012:00	–	ics
attackerkb	CVE-2020-6287: Critical Vulnerability in SAP NetWeaver Application Server (AS) Java	14 Jul 202013:15	–	attackerkb
Information Security Automation	Barapass, Tsunami scanner, vulnerabilities in Windows DNS Server and SAP products, weird attack on Twitter	18 Jul 202018:31	–	avleonov
BDU FSTEC	SAP NetWeaver Java Application Server Auth Bypass	21 Apr 202100:00	–	bdu_fstec
Circl	CVE-2020-6287	14 Jul 202008:44	–	circl

NVD

Vulners

Node

sap netweaver_application_server_javaMatch7.30

sap netweaver_application_server_javaMatch7.31

sap netweaver_application_server_javaMatch7.40

sap netweaver_application_server_javaMatch7.50

[
  {
    "product": "SAP NetWeaver AS JAVA (LM Configuration Wizard)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.30"
      },
      {
        "status": "affected",
        "version": "< 7.31"
      },
      {
        "status": "affected",
        "version": "< 7.40"
      },
      {
        "status": "affected",
        "version": "< 7.50"
      }
    ]
  }
]

Source	Link
onapsis	www.onapsis.com/recon-sap-cyber-security-vulnerability
seclists	www.seclists.org/fulldisclosure/2021/Apr/6
packetstormsecurity	www.packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html
launchpad	www.launchpad.support.sap.com/
wiki	www.wiki.scn.sap.com/wiki/pages/viewpage.action
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
PCKUser/username	request body	/CTCWebService/CTCWebServiceBean	Unauthenticated creation of a user via the CTCWebService SOAP interface.	CWE-306
PCKUser/password	request body	/CTCWebService/CTCWebServiceBean	Unauthenticated creation of a user via the CTCWebService SOAP interface.	CWE-306
SAP_XI_PCK_CONFIG/roleName	request body	/CTCWebService/CTCWebServiceBean	Unauthenticated creation of a user via the CTCWebService SOAP interface.	CWE-306
SAP_XI_PCK_COMMUNICATION/roleName	request body	/CTCWebService/CTCWebServiceBean	Unauthenticated creation of a user via the CTCWebService SOAP interface.	CWE-306
SAP_XI_PCK_MONITOR/roleName	request body	/CTCWebService/CTCWebServiceBean	Unauthenticated creation of a user via the CTCWebService SOAP interface.	CWE-306
SAP_XI_PCK_ADMIN/roleName	request body	/CTCWebService/CTCWebServiceBean	Unauthenticated creation of a user via the CTCWebService SOAP interface.	CWE-306
content/Netweaver/PI_PCK/PCK/PCKProcess.cproc	path	/CTCWebService/CTCWebServiceBean	Invocation of PCKProcess via a path parameter in the SOAP request.	CWE-306
content/Netweaver/ASJava/NWA/SPC/SPC_DeleteUser.cproc	path	/CTCWebService/CTCWebServiceBean	Invocation of SPC_DeleteUser via a path parameter in the SOAP request.	CWE-306

17 Jun 2026 03:23Current

10Critical risk

Vulners AI Score10

CVSS 3.110

CVSS 210

CVSS 310

EPSS0.94719

SSVC