CVE-2020-6286: sap se sap netweaver as java (lm configuration wizard) Path Traversal

Vulnerability summary

CVE-2020-6286 is a medium (CVSS 5.3) Path Traversal vulnerability in sap se sap netweaver as java (lm configuration wizard). EPSS estimates a 28.31% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities.

Timeline

1. 14-07-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.