Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-6257 State: PUBLISHED Published: 2020-05-12T17:53:05 Last Updated: 2024-08-04T08:55:22.255Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (CMC and BI launchpad) Problem Types: Cross Site Scripting Description: SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2907781
CVE ID: CVE-2020-6258 State: PUBLISHED Published: 2020-05-12T17:57:25 Last Updated: 2024-08-04T08:55:22.209Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Identity Management Problem Types: Missing Authorization Check Description: SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to view certain sensitive information of the victim, leading to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/291542
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2915429
CVE ID: CVE-2020-6259 State: PUBLISHED Published: 2020-05-12T17:56:15 Last Updated: 2024-08-04T08:55:22.271Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SAP SE Products: SAP Adaptive Server Enterprise Problem Types: Missing Authorization Check Description: Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise be restricted leading to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2920548
CVE ID: CVE-2020-6260 State: PUBLISHED Published: 2020-06-10T12:44:06 Last Updated: 2024-08-04T08:55:22.192Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: SAP SE Products: SAP Solution Manager (Trace Analysis) Problem Types: Incomplete XML Validation Description: SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.suppor
Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2915126
CVE ID: CVE-2020-6261 State: PUBLISHED Published: 2020-07-01T12:55:50 Last Updated: 2024-08-04T08:55:22.152Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: SAP SE Products: SAP Solution Manager (Trace Analysis) Problem Types: Incomplete XML Validation Description: SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The readability of the trace file is impaired. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2915126
CVE ID: CVE-2020-6262 State: PUBLISHED Published: 2020-05-12T17:51:57 Last Updated: 2024-08-04T08:55:22.163Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Application Server ABAP (ST-PI) Problem Types: Code Injection Description: Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wi
whole ABAP system leading to Code Injection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 - https://launchpad.support.sap.com/#/notes/2835979
CVE ID: CVE-2020-6263 State: PUBLISHED Published: 2020-06-10T12:44:43 Last Updated: 2024-08-04T08:55:22.315Z Severity: MEDIUM (CVSS 6.9 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H) Vendors: SAP SE Products: SAP NetWeaver AS JAVA Problem Types: Authentication Bypass Description: Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass. Additional Analyst Notes: - CVE Program Container: References: - http
re user identity leading to Authentication Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2878568
CVE ID: CVE-2020-6264 State: PUBLISHED Published: 2020-06-10T12:45:10 Last Updated: 2024-08-04T08:55:22.245Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: SAP SE Products: SAP Commerce Problem Types: Information Disclosure Description: SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2906366
CVE ID: CVE-2020-6265 State: PUBLISHED Published: 2020-06-09T18:24:14 Last Updated: 2024-08-04T08:55:22.177Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Commerce, SAP Commerce (Data Hub) Problem Types: CWE-798 Description: SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2918924 - https://wiki.scn.sap.com/
es: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2918924 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775
CVE ID: CVE-2020-6266 State: PUBLISHED Published: 2020-06-10T12:51:58 Last Updated: 2024-08-04T08:55:22.302Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Fiori for SAP S/4HANA Problem Types: URL Redirection Description: SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading to URL Redirection. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2911704 - https://launchpad.support.sap.com/#/notes/2911687
CVE ID: CVE-2020-6267 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.272Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: SAP SE Products: SAP Disclosure Management Problem Types: CWE-1004 Description: Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2758000
CVE ID: CVE-2020-6268 State: PUBLISHED Published: 2020-06-10T12:35:27 Last Updated: 2024-08-04T08:55:22.226Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: SAP SE Products: SAP ERP (Statutory Reporting for Insurance Companies) Problem Types: Missing Authorization Check Description: Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) does not execute the required authorization checks for an authenticated user, allowing an attacker to view and tamper with certain restricted data leading to Missing Authorization Check. Additional Analyst Notes: - CVE P
o view and tamper with certain restricted data leading to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2906996
CVE ID: CVE-2020-6269 State: PUBLISHED Published: 2020-06-10T12:37:29 Last Updated: 2024-08-04T08:55:22.156Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform Problem Types: Information Disclosure Description: Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2905836
CVE ID: CVE-2020-6270 State: PUBLISHED Published: 2020-06-10T12:36:10 Last Updated: 2024-08-04T08:55:22.334Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: SAP SE Products: SAP NetWeaver AS ABAP (Banking Services) Problem Types: Missing Authorization Check Description: SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated user due to Missing Authorization Check, allowing wrong and unexpected change of individual conditions by a malicious user leading to wrong prices. Additional Analyst Notes: - CVE Program Container: References: - https
ions by a malicious user leading to wrong prices. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2916562
CVE ID: CVE-2020-6271 State: PUBLISHED Published: 2020-06-10T12:38:29 Last Updated: 2024-08-04T08:55:22.314Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: SAP SE Products: SAP Solution Manager (Problem Context Manager) Problem Types: Missing XML Validation Description: SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and read restricted data (files visible for technical administration users of the diagnostics agent). Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/
iagnostics agent). Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2931391
CVE ID: CVE-2020-6272 State: PUBLISHED Published: 2020-10-15T01:46:38 Last Updated: 2024-08-04T08:55:22.297Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Commerce Cloud Problem Types: Cross Site Scripting Description: SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wik
n Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 - https://launchpad.support.sap.com/#/notes/2917381
CVE ID: CVE-2020-6273 State: PUBLISHED Published: 2020-08-12T13:19:40 Last Updated: 2024-08-04T08:55:22.195Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: SAP SE Products: SAP S/4 HANA (Fiori UI for General Ledger Accounting) Problem Types: Missing Authorization Check Description: SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticated user working with attachment service, allowing the attacker to delete attachments due to Missing Authorization Check. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2885671 - http
dditional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2885671 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345
CVE ID: CVE-2020-6275 State: PUBLISHED Published: 2020-06-10T12:39:02 Last Updated: 2024-08-04T08:55:22.250Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP Netweaver AS ABAP Problem Types: Server Side Request Forgery Description: SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise
the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775 - https://launchpad.support.sap.com/#/notes/2912939
CVE ID: CVE-2020-6276 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.335Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (bipodata) Problem Types: Cross Site Scripting Description: SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/2849967 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
CVE ID: CVE-2020-6278 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.330Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC) Problem Types: Cross Site Scripting Description: SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.c
g to Stored Cross Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2912708
CVE ID: CVE-2020-6279 State: REJECTED Published: 2020-06-10T12:43:46 Last Updated: 2020-09-04T14:56:08 Description: No description available.
CVE ID: CVE-2020-6280 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.265Z Severity: LOW (CVSS 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver (ABAP Server) and ABAP Platform Problem Types: Information Disclosure Description: SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise be restricted, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2927373
CVE ID: CVE-2020-6281 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.197Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Business Objects Business Intelligence Platform (BI Launchpad) Problem Types: Cross Site Scripting Description: SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2917743
CVE ID: CVE-2020-6282 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.289Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS) Problem Types: Server-Side Request Forgery Description: SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send a crafted request from a vulnerable web application. It is usually used to target internal systems b
an attacker to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2896025
CVE ID: CVE-2020-6283 State: PUBLISHED Published: 2020-09-09T12:51:11 Last Updated: 2024-08-04T08:55:22.250Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP SE Products: SAP Fiori(Launchpad) Problem Types: Cross Site Scripting Description: SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, the attacker can steal authentication information of the user, such as data relating to his or her current session. Additional Analyst Notes: - CVE
entication information of the user, such as data relating to his or her current session. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 - https://launchpad.support.sap.com/#/notes/2865229
CVE ID: CVE-2020-6284 State: PUBLISHED Published: 2020-08-12T13:21:04 Last Updated: 2024-08-04T08:55:22.312Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP NetWeaver (Knowledge Management) Problem Types: Cross Site Scripting Description: SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content could result in complete compromise of system confidentiality, integrity and availability, leading to Store
ript content could result in complete compromise of system confidentiality, integrity and availability, leading to Stored Cross Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345 - https://launchpad.support.sap.com/#/notes/2928635
CVE ID: CVE-2020-6285 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.414Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) Problem Types: Information Disclosure Description: SAP NetWeaver - XML Toolkit for JAVA (ENGINEAPI) (versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50), under certain conditions allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad
rogram Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2932473
CVE ID: CVE-2020-6286 State: PUBLISHED Published: 2020-07-14T12:30:14 Last Updated: 2024-08-04T08:55:22.280Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP SE Products: SAP NetWeaver AS JAVA (LM Configuration Wizard) Problem Types: Path Traversal Description: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewp
th Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2934135
CVE ID: CVE-2020-6287 State: PUBLISHED Published: 2020-07-14T12:30:14.000Z Last Updated: 2025-10-21T23:35:39.987Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SAP SE Products: SAP NetWeaver AS JAVA (LM Configuration Wizard) Problem Types: Missing Authentication Check Description: SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and
stem, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 - https://launchpad.support.sap.com/#/notes/2934135 - https://www.onapsis.com/recon-sap-cyber-security-vulnerability - http://seclists.org/fulldisclosure/2021/Apr/6 - http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html