CVE-2020-6286 — Path Traversal in SE SAP Netweaver AS Java

CWE-22 — Path Traversal4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
85.7%
top 0.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Netweaver AS JavaSAP Netweaver Application Server Java
Timeline
PublishedJul 14
Latest updateMay 24

Description

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5sap_se/sap_netweaver_as_java< 7.30+3
▶NVDsap/netweaver_application4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-xp68-m4r3-hpqf: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7↗2022-05-24
▶
CVEList
CVE-2020-6286: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7↗2020-07-14
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT SAP NetWeaver AS Directory Traversal Attempt Inbound (CVE-2020-6286)↗2020-07-16
▶
CVE-2020-6286 — Path Traversal | cvebase