CVE-2020-6287: SAP NetWeaver Missing Authentication for Critical Function Vulnerability

Vulnerability summary

CVE-2020-6287 is a critical (CVSS 10.0) vulnerability in SAP NetWeaver. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 94.72% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-07-2020
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVSAP NetWeaver Missing Authentication for Critical Function Vulnerability
3. 03-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.