CVE-2020-6318

Published Sep 9, 2020

Last updated 2 years ago

CVSS high 7.2

Overview

Description: A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Because of this, an attacker can exploit these products via Code Injection, and potentially enabling to take complete control of the products, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the products to terminate.
Source: cna@sap.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 3.0

Type: Secondary
Base score: 9.1
Impact score: 6
Exploitability score: 2.3
Vector string: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Primary
Base score: 6.5
Impact score: 6.4
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:700:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9AA5D36E-BE80-422B-8A6B-0ABDDE274146"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:701:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C04D8608-83F0-4D7F-A7A9-59B616240F14"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:702:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E4DF5956-1396-41FA-B101-E24F7898D135"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:710:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ADE0E878-BE4E-4CFD-907D-7ABB745A4CE8"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:711:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D14E8DCD-B365-4FC0-B08C-1A89787111C9"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:730:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "47631DD2-0504-449D-9460-4D4233EAAEF3"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:731:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CC2B8C19-4A66-44A8-9995-2BB71D8AA665"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:740:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "07710B18-BF01-4316-A258-4F1CB6269C5E"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:750:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A3A631DA-1279-49AC-922E-7D7216DACC8D"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:751:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "65320F25-669B-40D8-A246-07B0202C00A9"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:753:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E1C86F45-445E-4970-A378-199A35B23F4B"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:754:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "74901A8A-A556-478F-ABCD-7DCFD471210A"
          },
          {
            "criteria": "cpe:2.3:a:sap:abap_platform:755:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5B48E0FF-814F-4F9C-B5B1-87D978E1B4A4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 3.0

CVSS 2.0

Weaknesses

Social media

Configurations

References