CVE-2020-6287

🗓️ 14 Jul 2020 12:30:14Reported by sapType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 1275 Views

SAP NetWeaver AS JAVA allows unauthenticated attackers to execute configuration task

Reporter	Title	Published	Views	Family All 39
Gitee	Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java	27 Nov 202020:06	–	gitee
GithubExploit	Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java	21 Jul 202001:22	–	githubexploit
GithubExploit	Exploit for Path Traversal in Sap Netweaver_Application_Server_Java	15 Jul 202015:20	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java	20 Jul 202018:45	–	githubexploit
ICS	Critical Vulnerability in SAP NetWeaver AS Java	13 Jul 202012:00	–	ics
ATTACKERKB	CVE-2020-6287: Critical Vulnerability in SAP NetWeaver Application Server (AS) Java	14 Jul 202000:00	–	attackerkb
Information Security Automation	Barapass, Tsunami scanner, vulnerabilities in Windows DNS Server and SAP products, weird attack on Twitter	18 Jul 202018:31	–	avleonov
BDU FSTEC	The vulnerability of SAP NetWeaver Java Application Server, a software integration platform of SAP NetWeaver, related to authentication errors, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	21 Apr 202100:00	–	bdu_fstec
Circl	CVE-2020-6287	14 Jul 202008:44	–	circl
CISA KEV Catalog	SAP NetWeaver Missing Authentication for Critical Function Vulnerability	3 Nov 202100:00	–	cisa_kev

NVD

Vulners

Node

sap netweaver_application_server_javaMatch7.30

sap netweaver_application_server_javaMatch7.31

sap netweaver_application_server_javaMatch7.40

sap netweaver_application_server_javaMatch7.50

[
  {
    "product": "SAP NetWeaver AS JAVA (LM Configuration Wizard)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.30"
      },
      {
        "status": "affected",
        "version": "< 7.31"
      },
      {
        "status": "affected",
        "version": "< 7.40"
      },
      {
        "status": "affected",
        "version": "< 7.50"
      }
    ]
  }
]

Source	Link
wiki	www.wiki.scn.sap.com/wiki/pages/viewpage.action
packetstormsecurity	www.packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html
launchpad	www.launchpad.support.sap.com/
seclists	www.seclists.org/fulldisclosure/2021/Apr/6
onapsis	www.onapsis.com/recon-sap-cyber-security-vulnerability
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

31 Oct 2025 22:10Current

10High risk

Vulners AI Score10

CVSS 3.110

CVSS 210

CVSS 310

EPSS0.94719

SSVC