CVE-2020-6287 is a critical missing authentication check vulnerability in SAP NetWeaver AS JAVA versions 7.30, 7.31, 7.40, and 7.50. This flaw allows unauthenticated attackers to execute configuration tasks, including creating administrative users, thereby compromising the confidentiality, integrity, and availability of affected SAP systems. With a CVSS score of 10.0 (CRITICAL) and an EPSS score indicating high exploitability, it is easily exploitable over the network with low attack complexity, leading to complete system compromise. This vulnerability is actively exploited in the wild, with public Metasploit modules and Nuclei templates available, and has garnered significant community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7.30CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:* | ||
7.31CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:* | ||
7.40CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:* | ||
7.50CPE matchmatch criteria | cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.