Lucene search

[email protected]CVE-2020-6304

HistoryJan 14, 2020 - 6:15 p.m.

CVE-2020-6304

2020-01-1418:15:11

CWE-20

[email protected]

web.nvd.nist.gov

cve-2020-6304

sap

netweaver

internet communication manager

input validation

denial of service

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

45.7%

JSON

Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.

Affected configurations

NVD

Node

sapnetweaver_internet_communication_manager_\(kernel\)Match7.21

sapnetweaver_internet_communication_manager_\(kernel\)Match7.22

sapnetweaver_internet_communication_manager_\(kernel\)Match7.49

sapnetweaver_internet_communication_manager_\(kernel\)Match7.53

sapnetweaver_internet_communication_manager_\(krnl32nuc\)Match7.21

sapnetweaver_internet_communication_manager_\(krnl32nuc\)Match7.21ext

sapnetweaver_internet_communication_manager_\(krnl32nuc\)Match7.22

sapnetweaver_internet_communication_manager_\(krnl32nuc\)Match7.22ext

sapnetweaver_internet_communication_manager_\(krnl32uc\)Match7.21

sapnetweaver_internet_communication_manager_\(krnl32uc\)Match7.21ext

sapnetweaver_internet_communication_manager_\(krnl32uc\)Match7.22

sapnetweaver_internet_communication_manager_\(krnl32uc\)Match7.22ext

sapnetweaver_internet_communication_manager_\(krnl64nuc\)Match7.21

sapnetweaver_internet_communication_manager_\(krnl64nuc\)Match7.21ext

sapnetweaver_internet_communication_manager_\(krnl64nuc\)Match7.22

sapnetweaver_internet_communication_manager_\(krnl64nuc\)Match7.22ext

sapnetweaver_internet_communication_manager_\(krnl64nuc\)Match7.49

sapnetweaver_internet_communication_manager_\(krnl64uc\)Match7.21

sapnetweaver_internet_communication_manager_\(krnl64uc\)Match7.21ext

sapnetweaver_internet_communication_manager_\(krnl64uc\)Match7.22

sapnetweaver_internet_communication_manager_\(krnl64uc\)Match7.22ext

sapnetweaver_internet_communication_manager_\(krnl64uc\)Match7.49

CPENameOperatorVersion
sap:netweaver_internet_communication_manager_\(kernel\)sap netweaver internet communication manager (kernel)eq7.21
sap:netweaver_internet_communication_manager_\(kernel\)sap netweaver internet communication manager (kernel)eq7.22
sap:netweaver_internet_communication_manager_\(kernel\)sap netweaver internet communication manager (kernel)eq7.49
sap:netweaver_internet_communication_manager_\(kernel\)sap netweaver internet communication manager (kernel)eq7.53
sap:netweaver_internet_communication_manager_\(krnl32nuc\)sap netweaver internet communication manager (krnl32nuc)eq7.21
sap:netweaver_internet_communication_manager_\(krnl32nuc\)sap netweaver internet communication manager (krnl32nuc)eq7.21ext
sap:netweaver_internet_communication_manager_\(krnl32nuc\)sap netweaver internet communication manager (krnl32nuc)eq7.22
sap:netweaver_internet_communication_manager_\(krnl32nuc\)sap netweaver internet communication manager (krnl32nuc)eq7.22ext
sap:netweaver_internet_communication_manager_\(krnl32uc\)sap netweaver internet communication manager (krnl32uc)eq7.21
sap:netweaver_internet_communication_manager_\(krnl32uc\)sap netweaver internet communication manager (krnl32uc)eq7.21ext

CPE	Name	Operator	Version
sap:netweaver_internet_communication_manager_\(kernel\)	sap netweaver internet communication manager (kernel)	eq	7.21
sap:netweaver_internet_communication_manager_\(kernel\)	sap netweaver internet communication manager (kernel)	eq	7.22
sap:netweaver_internet_communication_manager_\(kernel\)	sap netweaver internet communication manager (kernel)	eq	7.49
sap:netweaver_internet_communication_manager_\(kernel\)	sap netweaver internet communication manager (kernel)	eq	7.53
sap:netweaver_internet_communication_manager_\(krnl32nuc\)	sap netweaver internet communication manager (krnl32nuc)	eq	7.21
sap:netweaver_internet_communication_manager_\(krnl32nuc\)	sap netweaver internet communication manager (krnl32nuc)	eq	7.21ext
sap:netweaver_internet_communication_manager_\(krnl32nuc\)	sap netweaver internet communication manager (krnl32nuc)	eq	7.22
sap:netweaver_internet_communication_manager_\(krnl32nuc\)	sap netweaver internet communication manager (krnl32nuc)	eq	7.22ext
sap:netweaver_internet_communication_manager_\(krnl32uc\)	sap netweaver internet communication manager (krnl32uc)	eq	7.21
sap:netweaver_internet_communication_manager_\(krnl32uc\)	sap netweaver internet communication manager (krnl32uc)	eq	7.21ext

Rows per page:

1-10 of 221

CNA Affected

[
  {
    "product": "SAP NetWeaver Internet Communication Manager (KRNL32NUC)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.21EXT"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      }
    ]
  },
  {
    "product": "SAP NetWeaver Internet Communication Manager (KRNL32UC)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.21EXT"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      }
    ]
  },
  {
    "product": "SAP NetWeaver Internet Communication Manager (KRNL64NUC)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.21EXT"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      },
      {
        "status": "affected",
        "version": "< 7.49"
      }
    ]
  },
  {
    "product": "SAP NetWeaver Internet Communication Manager (KRNL64UC)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.21EXT"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.22EXT"
      },
      {
        "status": "affected",
        "version": "< 7.49"
      }
    ]
  },
  {
    "product": "SAP NetWeaver Internet Communication Manager (KERNEL)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.21"
      },
      {
        "status": "affected",
        "version": "< 7.22"
      },
      {
        "status": "affected",
        "version": "< 7.49"
      },
      {
        "status": "affected",
        "version": "< 7.53"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2848498

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

45.7%

JSON

Related for CVE-2020-6304

prion1 nvd1 symantec1 cvelist1