CVE-2020-6263: sap_se sap netweaver as java
Vulnerability summary
CVE-2020-6263 is a critical (CVSS 9.8) vulnerability in sap_se sap netweaver as java. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.9% of scored vulnerabilities.
Timeline
- 10-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST6.9MediumCVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
EPSS trend
Probability
1.44%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.44% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_application_server_java7.00 | 7.01 | 7.02 | 7.05 | 7.10 | 7.11 | 7.20 | 7.30 | 7.31 | 7.40 | 7.50
Sap_se1 product
- sap netweaver as java< SAP-JEECOR 7.00 | < 7.01 SERVERCOR 7.10 | < 7.11 | < 7.20 | < 7.30 | < 7.31 | < 7.40 | < 7.50 CORE-TOOLS 7.00 | < 7.01 | < 7.02 | < 7.05 | < 7.10 | < 7.50
2 vendors · 2 products