CVE-2020-6263

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cna@sap.com

Published

2020-06-10

Last modified

2024-08-04

Weaknesses

CWE-306

Affected products

• Netweaver Application Server Java (Sap)
• Sap Netweaver As Java (Sap Se)

References

• https://launchpad.support.sap.com/#/notes/2878568
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775