CVE-2020-6286

🗓️ 14 Jul 2020 12:30:14Reported by sapType

Insufficient input path validation in SAP NetWeaver AS JAV

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for Path Traversal in Sap Netweaver_Application_Server_Java	15 Jul 202015:20	–	githubexploit
GithubExploit	Exploit for Path Traversal in Sap Netweaver_Application_Server_Java	13 Aug 202009:00	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java	20 Jul 202018:45	–	githubexploit
Information Security Automation	Barapass, Tsunami scanner, vulnerabilities in Windows DNS Server and SAP products, weird attack on Twitter	18 Jul 202018:31	–	avleonov
Circl	CVE-2020-6286	16 Jul 202019:08	–	circl
CNVD	SAP NetWeaver AS JAVA Path Traversal Vulnerability	20 Nov 202000:00	–	cnvd
Check Point Advisories	SAP NetWeaver Directory Traversal (CVE-2020-6286; CVE-2020-6287)	21 Jul 202000:00	–	checkpoint_advisories
CVE	CVE-2020-6286	14 Jul 202012:30	–	cve
Hacker One	Acronis: Found multiple SAP NetWeaver vulnerable services	14 Feb 202114:49	–	hackerone
NCSC	Serious vulnerabilities fixed in SAP Netweaver	14 Jul 202000:00	–	ncsc

[
  {
    "product": "SAP NetWeaver AS JAVA (LM Configuration Wizard)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.30"
      },
      {
        "status": "affected",
        "version": "< 7.31"
      },
      {
        "status": "affected",
        "version": "< 7.40"
      },
      {
        "status": "affected",
        "version": "< 7.50"
      }
    ]
  }
]

Source	Link
wiki	www.wiki.scn.sap.com/wiki/pages/viewpage.action
launchpad	www.launchpad.support.sap.com/

14 Jul 2020 12:30Current

6.3Medium risk

Vulners AI Score6.3

CVSS 35.3

EPSS0.85681