Lucene search

[email protected]CVE-2020-6310

HistoryAug 12, 2020 - 2:15 p.m.

CVE-2020-6310

2020-08-1214:15:14

[email protected]

web.nvd.nist.gov

sap

netweaver

soa

configuration

trace

access control

authentication

information disclosure

cve-2020-6310

nvd

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

22.5%

JSON

Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure.

Affected configurations

NVD

Node

sapabap_platformMatch7.31

sapabap_platformMatch7.40

sapabap_platformMatch7.50

sapabap_platformMatch700

sapabap_platformMatch701

sapabap_platformMatch702

sapabap_platformMatch710

sapabap_platformMatch711

sapabap_platformMatch751

sapabap_platformMatch753

sapabap_platformMatch755

sapnetweaver_application_server_abapMatch700

sapnetweaver_application_server_abapMatch701

sapnetweaver_application_server_abapMatch702

sapnetweaver_application_server_abapMatch710

sapnetweaver_application_server_abapMatch711

sapnetweaver_application_server_abapMatch731

sapnetweaver_application_server_abapMatch740

sapnetweaver_application_server_abapMatch750

sapnetweaver_application_server_abapMatch751

sapnetweaver_application_server_abapMatch753

sapnetweaver_application_server_abapMatch755

CPENameOperatorVersion
sap:abap_platformsap abap platformeq7.31
sap:abap_platformsap abap platformeq7.40
sap:abap_platformsap abap platformeq7.50
sap:abap_platformsap abap platformeq700
sap:abap_platformsap abap platformeq701
sap:abap_platformsap abap platformeq702
sap:abap_platformsap abap platformeq710
sap:abap_platformsap abap platformeq711
sap:abap_platformsap abap platformeq751
sap:abap_platformsap abap platformeq753

CPE	Name	Operator	Version
sap:abap_platform	sap abap platform	eq	7.31
sap:abap_platform	sap abap platform	eq	7.40
sap:abap_platform	sap abap platform	eq	7.50
sap:abap_platform	sap abap platform	eq	700
sap:abap_platform	sap abap platform	eq	701
sap:abap_platform	sap abap platform	eq	702
sap:abap_platform	sap abap platform	eq	710
sap:abap_platform	sap abap platform	eq	711
sap:abap_platform	sap abap platform	eq	751
sap:abap_platform	sap abap platform	eq	753

Rows per page:

1-10 of 221

CNA Affected

[
  {
    "product": "SAP NetWeaver (ABAP Server) and ABAP Platform",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 702"
      },
      {
        "status": "affected",
        "version": "< 730"
      },
      {
        "status": "affected",
        "version": "< 731"
      },
      {
        "status": "affected",
        "version": "< 740"
      },
      {
        "status": "affected",
        "version": "< 750"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2944988

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345

Social References

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

22.5%

JSON

Related for CVE-2020-6310

cvelist1 prion1 nvd1