CVE-2020-6287

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS JAVA (LM Configuration Wizard)	< 7.30; < 7.31; < 7.40; < 7.50

References

http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Apr/6Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2934135Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675Broken Link, Vendor Advisory
https://www.onapsis.com/recon-sap-cyber-security-vulnerabilityThird Party Advisory
http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Apr/6Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2934135Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675Broken Link, Vendor Advisory
https://www.onapsis.com/recon-sap-cyber-security-vulnerabilityThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287US Government Resource

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-62885.3SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) allows an attacker with edit document rights to upload CVE-2020-62898.8SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user i CVE-2020-62906.3SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specifi CVE-2020-62918.8SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authent CVE-2020-62928.8Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session CVE-2020-62936.5SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and a CVE-2020-62949.1Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication check CVE-2020-62957.8Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential CVE-2020-62968.8SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to CVE-2020-62974.4Under certain conditions the upgrade of SAP Data Hub 2.7 to SAP Data Intelligence, version - 3.0, allows an attacker to access confidential CVE-2020-62988.1SAP Banking Services (Generic Market Data), versions - 400, 450, 500, allows an unauthorized user to display protected Business Partner Gene CVE-2020-62994.3SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of us