CNVD-2020-38866 — Vulnetix

CNVD-2020-38866 PUBLISHED CVSS 10 CRITICAL

SAP Netweaver是德国思爱普（SAP）公司的一套面向服务的集成化应用平台。该平台主要为SAP应用程序提供开发和运行环境。SAP NetWeaver Application Server（AS）Java是一款运行于NetWeaver中且基于Java编程语言的应用服务器。 SAP NetWeaver AS Java（LM配置向导）7.30至7.50版本存在安全漏洞。未经身份验证的远程攻击者可以通过创建具有最大特权的新SAP用户，绕过所有访问和授权控制，从而完全控制SAP系统。

Risk Scores

CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS JAVA (LM Configuration Wizard)	< 7.30, < 7.31, < 7.50

Exploit Intelligence

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287 (circl)
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 (circl)
https://launchpad.support.sap.com/#/notes/2934135 (circl)
https://www.onapsis.com/recon-sap-cyber-security-vulnerability (circl)
20210405 Onapsis Security Advisory 2021-0003: [CVE-2020-6287] - [SAP RECON] SAP JAVA: Unauthenticated execution of configuration tasks (circl)
http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html (circl)
CIRCL exploited: CVE-2020-6287 (circl-sighting)
CIRCL seen: CVE-2020-6287 (circl-sighting)
CIRCL exploited: CVE-2020-6287 (circl-sighting)
CIRCL seen: CVE-2020-6287 (circl-sighting)

…and 14 more exploits

Timeline

Apr 17, 2019 CVE Published
Jul 23, 2020 PoC Published
Nov 8, 2021 PoC Published
Nov 20, 2021 PoC Published
Nov 14, 2024 PoC Published
Dec 24, 2024 PoC Published
Jan 12, 2025 PoC Published
Jan 26, 2025 PoC Published
Feb 6, 2025 PoC Published
Feb 23, 2025 PoC Published
Feb 23, 2025 PoC Published
Jun 5, 2025 PoC Published

References

Open in Interactive Console →