Lucene search

SapCVE-2020-6190

HistoryFeb 12, 2020 - 8:15 p.m.

CVE-2020-6190

2020-02-1220:15:14

CWE-200

sap

web.nvd.nist.gov

cve-2020-6190

sap

netweaver

as java

heap dump application

information disclosure

nvd

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure.

Affected configurations

Nvd

Node

sapnetweaver_application_server_javaMatch7.30

sapnetweaver_application_server_javaMatch7.31

sapnetweaver_application_server_javaMatch7.40

sapnetweaver_application_server_javaMatch7.50

VendorProductVersionCPE
sapnetweaver_application_server_java7.30cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*
sapnetweaver_application_server_java7.31cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:*
sapnetweaver_application_server_java7.40cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*
sapnetweaver_application_server_java7.50cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	netweaver_application_server_java	7.30	cpe:2.3:a:sap:netweaver_application_server_java:7.30:::::::*
sap	netweaver_application_server_java	7.31	cpe:2.3:a:sap:netweaver_application_server_java:7.31:::::::*
sap	netweaver_application_server_java	7.40	cpe:2.3:a:sap:netweaver_application_server_java:7.40:::::::*
sap	netweaver_application_server_java	7.50	cpe:2.3:a:sap:netweaver_application_server_java:7.50:::::::*

CNA Affected

[
  {
    "product": "SAP NetWeaver AS Java (Heap Dump Application)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "= 7.30"
      },
      {
        "status": "affected",
        "version": "= 7.31"
      },
      {
        "status": "affected",
        "version": "= 7.40"
      },
      {
        "status": "affected",
        "version": "= 7.50"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2838835

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

38.7%

JSON

Related for CVE-2020-6190