CVE-2020-6263

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sapCNA
6.9 MEDIUM
ADJACENT_NETWORK
LOW
HIGH
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
VendorProductVersion
sapnetweaver_application_server_java
7.00
sapnetweaver_application_server_java
7.01
sapnetweaver_application_server_java
7.02
sapnetweaver_application_server_java
7.05
sapnetweaver_application_server_java
7.10
sapnetweaver_application_server_java
7.11
sapnetweaver_application_server_java
7.20
sapnetweaver_application_server_java
7.30
sapnetweaver_application_server_java
7.31
sapnetweaver_application_server_java
7.40
sapnetweaver_application_server_java
7.50
𝑥
= Vulnerable software versions