{"schemaVersion":3,"id":"CVE-2020-6287","aliases":[],"status":"published","duplicateOf":null,"title":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","description":"SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.","dates":{"published":"2020-07-14T12:30:14.000Z","modified":"2025-10-21T23:35:39.987Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"critical","version":"3.0","versionLabel":"v3.0","source":"CVE.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":10,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":10,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.94719,"percentile":0.9986,"severity":"critical","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.94719},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.94719,"percentile":0.9986}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.94719,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.94719,"percentile":0.9986}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","description":"SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2020-6287","label":"nvd.nist.gov/vuln/detail/CVE-2020-6287"}],"vendor":"SAP","product":"NetWeaver","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","description":"SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2020-6287","label":"nvd.nist.gov/vuln/detail/CVE-2020-6287"}],"vendor":"SAP","product":"NetWeaver","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"MSF_AUXILIARY_ADMIN_SAP_CVE_2020_6287_WS_ADD_USER","name":"SAP Unauthenticated WebService User Creation","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/cve_2020_6287_ws_add_user.rb","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":[],"requiresAuth":true,"exploitdb":null,"metasploit":{"fullname":"auxiliary/admin/sap/cve_2020_6287_ws_add_user","rank":"300","rankName":"normal","postAuth":true,"check":true,"stability":["crash-safe"],"sideEffects":["config-changes","ioc-in-logs"],"reliability":[]}}],"exploitCount":1,"weaknesses":[{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html"}],"affected":[{"vendor":"sap se","product":"sap netweaver as java (lm configuration wizard)","name":"SAP NetWeaver AS JAVA (LM Configuration Wizard)","label":"sap netweaver as java (lm configuration wizard)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.30","noFixRecorded":false,"fixedIn":null},{"text":"< 7.31","noFixRecorded":false,"fixedIn":null},{"text":"< 7.40","noFixRecorded":false,"fixedIn":null},{"text":"< 7.50","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.30 | < 7.31 | < 7.40 | < 7.50","eol":null,"hubHref":"/vendor/sap_se/sap_netweaver_as_java_lm_configuration_wizard"},{"vendor":"sap","product":"netweaver_application_server_java","name":"netweaver application server java","label":"netweaver_application_server_java","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.30","noFixRecorded":false,"fixedIn":null},{"text":"7.31","noFixRecorded":false,"fixedIn":null},{"text":"7.40","noFixRecorded":false,"fixedIn":null},{"text":"7.50","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.30 | 7.31 | 7.40 | 7.50","eol":null,"hubHref":"/vendor/sap/netweaver_application_server_java"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675","label":"wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675","hostname":"wiki.scn.sap.com","tags":["X Refsource MISC","Broken Link","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2934135","label":"launchpad.support.sap.com","hostname":"launchpad.support.sap.com","tags":["X Refsource MISC","Permissions Required","Vendor Advisory"]},{"url":"https://www.onapsis.com/recon-sap-cyber-security-vulnerability","label":"www.onapsis.com/recon-sap-cyber-security-vulnerability","hostname":"www.onapsis.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Apr/6","label":"seclists.org/fulldisclosure/2021/Apr/6","hostname":"seclists.org","tags":["Mailing List","X Refsource FULLDISC","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html","label":"packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-07-14T12:30:14.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:35:39.987Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T17:39:30.329Z","stale":false,"partial":false}}