CVE-2020-6287criticalunder attackCWE-306

CVE-2020-6287: critical vulnerability in SAP NetWeaver AS JAVA (LM Configuration Wizard)

Published · Updated

Follow this CVE+ Monitor SAP NetWeaver+ Monitor SAP NetWeaver AS Java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 95%
from disclosure to weapon1 day
Published on NVDJul 14
1st PoC+1d
metasploitJul 14
CISA KEV+477d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

SAP NetWeaver AS JAVA's Configuration Wizard fails to verify user identity, letting anyone access it without logging in. An attacker can use this to create admin accounts and take complete control of the system.

Technical detail

The LM Configuration Wizard in SAP NetWeaver AS JAVA (versions 7.30–7.50) lacks authentication validation on configuration endpoints, allowing unauthenticated remote attackers to execute privileged operations such as administrative user creation. This results in complete compromise of system confidentiality, integrity, and availability through direct access to sensitive configuration functions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
SAP SE · SAP NetWeaver AS JAVA (LM Configuration Wizard)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SAP NetWeaver AS JAVA (LM Configuration Wizard)

In the same product, most dangerous first.

CVE-2020-6286MEDIUMCVE-2020-6286EPSS 24.3%