cnvd - cnvd-2021-25953

CNVD-2021-25953

Vulnerability from cnvd - Published: 2021-04-08

Title

SAP NetWeaver AS ABAP拒绝服务漏洞（CNVD-2021-25953）

Description

SAP Netweaver AS ABAP是一款运行于NetWeaver中且基于ABAP高级编程语言的应用服务器。 SAP NetWeaver AS ABAP存在拒绝服务漏洞。攻击者可利用该漏洞通过使服务崩溃或通过泛洪攻击阻止合法用户访问该服务。

Severity

中

Patch Name

SAP NetWeaver AS ABAP拒绝服务漏洞（CNVD-2021-25953）的补丁

Patch Description

SAP Netweaver AS ABAP是一款运行于NetWeaver中且基于ABAP高级编程语言的应用服务器。 SAP NetWeaver AS ABAP存在拒绝服务漏洞。攻击者可利用该漏洞通过使服务崩溃或通过泛洪攻击阻止合法用户访问该服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-6240

Impacted products

Name
['SAP NetWeaver AS ABAP 700', 'SAP NetWeaver AS ABAP 730', 'SAP NetWeaver AS ABAP 731', 'SAP NetWeaver AS ABAP 750', 'SAP NetWeaver AS ABAP 752', 'SAP NetWeaver AS ABAP 753', 'SAP NetWeaver AS ABAP 754']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-6240"
    }
  },
  "description": "SAP Netweaver AS ABAP\u662f\u4e00\u6b3e\u8fd0\u884c\u4e8eNetWeaver\u4e2d\u4e14\u57fa\u4e8eABAP\u9ad8\u7ea7\u7f16\u7a0b\u8bed\u8a00\u7684\u5e94\u7528\u670d\u52a1\u5668\u3002\n\nSAP NetWeaver AS ABAP\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u4f7f\u670d\u52a1\u5d29\u6e83\u6216\u901a\u8fc7\u6cdb\u6d2a\u653b\u51fb\u963b\u6b62\u5408\u6cd5\u7528\u6237\u8bbf\u95ee\u8be5\u670d\u52a1\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-25953",
  "openTime": "2021-04-08",
  "patchDescription": "SAP Netweaver AS ABAP\u662f\u4e00\u6b3e\u8fd0\u884c\u4e8eNetWeaver\u4e2d\u4e14\u57fa\u4e8eABAP\u9ad8\u7ea7\u7f16\u7a0b\u8bed\u8a00\u7684\u5e94\u7528\u670d\u52a1\u5668\u3002\r\n\r\nSAP NetWeaver AS ABAP\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u4f7f\u670d\u52a1\u5d29\u6e83\u6216\u901a\u8fc7\u6cdb\u6d2a\u653b\u51fb\u963b\u6b62\u5408\u6cd5\u7528\u6237\u8bbf\u95ee\u8be5\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP NetWeaver AS ABAP\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2021-25953\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP NetWeaver AS ABAP 700",
      "SAP NetWeaver AS ABAP 730",
      "SAP NetWeaver AS ABAP 731",
      "SAP NetWeaver AS ABAP 750",
      "SAP NetWeaver AS ABAP 752",
      "SAP NetWeaver AS ABAP 753",
      "SAP NetWeaver AS ABAP 754"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-6240",
  "serverity": "\u4e2d",
  "submitTime": "2020-05-13",
  "title": "SAP NetWeaver AS ABAP\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2021-25953\uff09"
}

CVE-2020-6240 (GCVE-0-2020-6240)

Vulnerability from cvelistv5 – Published: 2020-05-12 17:46 – Updated: 2024-08-04 08:55

Summary

SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service

Severity ?

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

Denial of Service

Assigner

sap

References

URL

Tags

	https://launchpad.support.sap.com/#/notes/2856923	x_refsource_MISC
	https://wiki.scn.sap.com/wiki/pages/viewpage.acti…	x_refsource_MISC

Impacted products

Vendor

Product

Version

SAP SE

SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI)

Affected: < 750
Affected: < 752
Affected: < 753
Affected: < 754

SAP SE

SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS)

Affected: < 700
Affected: < 710
Affected: < 730
Affected: < 731
Affected: < 804

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:55:22.180Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2856923"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 750"
            },
            {
              "status": "affected",
              "version": "\u003c 752"
            },
            {
              "status": "affected",
              "version": "\u003c 753"
            },
            {
              "status": "affected",
              "version": "\u003c 754"
            }
          ]
        },
        {
          "product": "SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS)",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 700"
            },
            {
              "status": "affected",
              "version": "\u003c 710"
            },
            {
              "status": "affected",
              "version": "\u003c 730"
            },
            {
              "status": "affected",
              "version": "\u003c 731"
            },
            {
              "status": "affected",
              "version": "\u003c 804"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-12T17:46:58",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2856923"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2020-6240",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "750"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "752"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "753"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "754"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS)",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "700"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "710"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "730"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "731"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "804"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service"
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://launchpad.support.sap.com/#/notes/2856923",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/2856923"
            },
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2020-6240",
    "datePublished": "2020-05-12T17:46:58",
    "dateReserved": "2020-01-08T00:00:00",
    "dateUpdated": "2024-08-04T08:55:22.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-25953

CVE-2020-6240 (GCVE-0-2020-6240)

Tags

Sightings

Nomenclature