CVE-2020-6243

CWE-94 — Code InjectionCWE-743 documents3 sources
Severity
8.8HIGH
EPSS
0.7%
top 28.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Adaptive Server Enterprise (XP Server ON Windows Platform)SAP Adaptive Server Enterprise
Timeline
PublishedMay 12
Latest updateMay 24

Description

Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDsap/adaptive15.7, 16.0+1

🔴Vulnerability Details

2
GHSA
GHSA-c4hv-hmhc-gj65: Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15↗2022-05-24
▶
CVEList
CVE-2020-6243: Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15↗2020-05-12
▶