CVE-2020-6243

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
SAP SE	SAP Adaptive Server Enterprise (XP Server on Windows Platform)	< 15.7; < 16.0

References

https://launchpad.support.sap.com/#/notes/2915585Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Vendor Advisory
https://launchpad.support.sap.com/#/notes/2915585Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222Vendor Advisory

Timeline

Published: May 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-62447.8SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in CVE-2020-62456.7SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code t CVE-2020-62466.1SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, CVE-2020-62477.5SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from access CVE-2020-62487.2SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user whi CVE-2020-62498.8The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an CVE-2020-62506.8SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the a CVE-2020-62516.5Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access i CVE-2020-62528.0Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sen CVE-2020-62537.2Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafte CVE-2020-62546.1SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payloa CVE-2020-62564.3SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details with