CVE-2020-6310

CWE-200 — Information Exposure3 documents3 sources

Severity

4.3MEDIUM

EPSS

0.3%

top 50.66%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SAP SE SAP Netweaver (abap Server) AND Abap Platform SAP Abap Platform SAP Netweaver Application Server Abap

Timeline

PublishedAug 12

Latest updateMay 24

Description

Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Information Disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5sap_se/sap_netweaver_(abap_server)_and_abap_platform< 702+4

▶NVDsap/abap_platform11 versions+10

▶NVDsap/netweaver_application11 versions+10

🔴Vulnerability Details

GHSA

GHSA-cvcj-pj4r-5rm5: Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, all↗2022-05-24

▶

CVEList

CVE-2020-6310: Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, all↗2020-08-12

▶