SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition

SAP NetWeaver AS JAVA LM Configuration Wizard, versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an...

SAP Unauthenticated WebService User Creation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Unauthenticated WebService User Creation', 'Description' = %q This module leverages an unauthenticated web service to submit a job which will...

Acronis: CVE-2020-6287 https://redapi2.acronis.com

Hi team. Summary CVE-2020-6287 https://redapi2.acronis.com https://nvd.nist.gov/vuln/detail/CVE-2020-6287 SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute...

SAP Unauthenticated WebService User Creation

This module leverages an unauthenticated web service to submit a job which will create a user with a specified role. The job involves running a wizard. After the necessary action is taken, the job is canceled to avoid unnecessary system changes. Module Options msf use...

Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java

Vulnerability Assessment and Indicator of Compromise IoC Sca...

SAP NetWeaver Directory Traversal (CVE-2020-6286; CVE-2020-6287)

A directory traversal vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could lead to disclosure of file contents accessible by the prime user...

Exploit for Missing Authentication for Critical Function in Sap Netweaver_Application_Server_Java

CVE-2020-6287-exploit PoC for CVE-2020-6287 The PoC in...

SAP NetWeaver : Authentication Bypass (CVE-2020-6287) (Direct Check)

Binary data sapnwcve-2020-6287.nbin...

Exploit for Path Traversal in Sap Netweaver_Application_Server_Java

PoC for CVE-2020-6287, CVE-2020-6286 SAP RECON vulnerability...

CVE-2020-6287

CVE-2020-6287 affects SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30–7.50. The vulnerability is a missing authentication check that allows an unauthenticated attacker to execute configuration tasks and create an administrative user, thereby compromising Confidentiality, Integrity a...

CVE-2020-6287

creationtimestamp| type| source ---|---|--- 2020-07-14 08:44:29+00:00| seen| https://t.me/cKure/1274 2020-07-14 09:24:21+00:00| seen| https://t.me/thehackernews/759 2020-07-14 14:42:55+00:00| exploited| https://t.me/informationsecuritychannel/39176 2020-07-14 18:09:32+00:00| seen|...

New Highly-Critical SAP Bug Could Let Attackers Take Over Corporate Servers

SAP has patched a critical vulnerability impacting the LM Configuration Wizard component in NetWeaver Application Server AS Java platform, allowing an unauthenticated attacker to take control of SAP applications. The bug, dubbed RECON and tracked as CVE-2020-6287, is rated with a maximum CVSS sco...

Critical Vulnerability in SAP NetWeaver AS Java

Summary On July 13, 2020 EST, SAP released a security update to address a critical vulnerability, CVE-2020-6287, affecting the SAP NetWeaver Application Server AS Java component LM Configuration Wizard. An unauthenticated attacker can exploit this vulnerability through the Hypertext Transfer...