CVE-2020-6275

published 2020-06-10

CVE-2020-6275: SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in…

Priority P3 53 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database.

Affected

26 ranges · showing 25

Vendor	Product	Version range	Fixed in
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap_se	sap_netweaver_as_abap	< 700	700
sap_se	sap_netweaver_as_abap	< 701	701
sap_se	sap_netweaver_as_abap	< 702	702
sap_se	sap_netweaver_as_abap	< 710	710
sap_se	sap_netweaver_as_abap	< 711	711
sap_se	sap_netweaver_as_abap	< 730	730
sap_se	sap_netweaver_as_abap	< 731	731
sap_se	sap_netweaver_as_abap	< 740	740
sap_se	sap_netweaver_as_abap	< 750	750
sap_se	sap_netweaver_as_abap	< 751	751
sap_se	sap_netweaver_as_abap	< 752	752
sap_se	sap_netweaver_as_abap	< 753	753

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 7.6 HIGH CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918