CVE-2020-6287: sap netweaver application server java

csirt@kutim:~/threat-intel/cve/CVE-2020-6287

CVSS 10.0 · Critical KEV · sudah dieksploitasi EPSS 94,7%

Kerentanan Missing Authentication for Critical Function pada sap netweaver application server java. Skor CVSS 3.1 10.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

Rincian

Terbit di NVD: 14 Juli 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-306: Missing Authentication for Critical Function
EPSS (30 hari): 94,7% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: SAP NetWeaver Missing Authentication for Critical Function Vulnerability
Masuk KEV: 3 November 2021
Tenggat CISA: 3 Mei 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sap	netweaver application server java	Versi 7.30
sap	netweaver application server java	Versi 7.31
sap	netweaver application server java	Versi 7.40
sap	netweaver application server java	Versi 7.50

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://launchpad.support.sap.com/#/notes/2934135 permissions required · advisory vendor
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 broken link · advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287 pemerintah AS
http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html advisory pihak ketiga · vdb entry
http://seclists.org/fulldisclosure/2021/Apr/6 mailing list · advisory pihak ketiga
https://www.onapsis.com/recon-sap-cyber-security-vulnerability advisory pihak ketiga

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.