Lucene search

[email protected]CVE-2020-6309

HistoryAug 12, 2020 - 2:15 p.m.

CVE-2020-6309

2020-08-1214:15:14

CWE-306

[email protected]

web.nvd.nist.gov

sap

netweaver

as java

cve-2020-6309

denial of service

nvd

vulnerability

security advisory

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.8%

JSON

SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication checks for a web service allowing the attacker to send several payloads and leading to complete denial of service.

Affected configurations

NVD

Node

sapnetweaver_application_server_javaMatch7.10

sapnetweaver_application_server_javaMatch7.11

sapnetweaver_application_server_javaMatch7.20

sapnetweaver_application_server_javaMatch7.30

sapnetweaver_application_server_javaMatch7.31

sapnetweaver_application_server_javaMatch7.40

sapnetweaver_application_server_javaMatch7.50

CPENameOperatorVersion
sap:netweaver_application_server_javasap netweaver application server javaeq7.10
sap:netweaver_application_server_javasap netweaver application server javaeq7.11
sap:netweaver_application_server_javasap netweaver application server javaeq7.20
sap:netweaver_application_server_javasap netweaver application server javaeq7.30
sap:netweaver_application_server_javasap netweaver application server javaeq7.31
sap:netweaver_application_server_javasap netweaver application server javaeq7.40
sap:netweaver_application_server_javasap netweaver application server javaeq7.50

CPE	Name	Operator	Version
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.10
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.11
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.20
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.30
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.31
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.40
sap:netweaver_application_server_java	sap netweaver application server java	eq	7.50

CNA Affected

[
  {
    "product": "SAP NetWeaver AS JAVA (ENGINEAPI)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.10"
      }
    ]
  },
  {
    "product": "SAP NetWeaver AS JAVA (WSRM)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.10"
      },
      {
        "status": "affected",
        "version": "< 7.11"
      },
      {
        "status": "affected",
        "version": "< 7.20"
      },
      {
        "status": "affected",
        "version": "< 7.30"
      },
      {
        "status": "affected",
        "version": "< 7.31"
      },
      {
        "status": "affected",
        "version": "< 7.40"
      },
      {
        "status": "affected",
        "version": "< 7.50"
      }
    ]
  },
  {
    "product": "SAP NetWeaver AS JAVA (J2EE-FRMW)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.10"
      },
      {
        "status": "affected",
        "version": "< 7.11"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2941315

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345

Social References

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.8%

JSON

Related for CVE-2020-6309

prion1 cvelist1 nvd1 nessus1