fkie_cve-2020-6318
Vulnerability from fkie_nvd
Published
2020-09-09 13:15
Modified
2024-11-21 05:35
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Because of this, an attacker can exploit these products via Code Injection, and potentially enabling to take complete control of the products, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the products to terminate.
References
cna@sap.comhttp://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
cna@sap.comhttp://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
cna@sap.comhttps://launchpad.support.sap.com/#/notes/2958563Permissions Required
cna@sap.comhttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/2958563Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700Vendor Advisory
Impacted products
Vendor Product Version
sap abap_platform 700
sap abap_platform 701
sap abap_platform 702
sap abap_platform 710
sap abap_platform 711
sap abap_platform 730
sap abap_platform 731
sap abap_platform 740
sap abap_platform 750
sap abap_platform 751
sap abap_platform 753
sap abap_platform 754
sap abap_platform 755


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:700:*:*:*:*:*:*:*",
              "matchCriteriaId": "9AA5D36E-BE80-422B-8A6B-0ABDDE274146",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:701:*:*:*:*:*:*:*",
              "matchCriteriaId": "C04D8608-83F0-4D7F-A7A9-59B616240F14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:702:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4DF5956-1396-41FA-B101-E24F7898D135",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:710:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADE0E878-BE4E-4CFD-907D-7ABB745A4CE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:711:*:*:*:*:*:*:*",
              "matchCriteriaId": "D14E8DCD-B365-4FC0-B08C-1A89787111C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:730:*:*:*:*:*:*:*",
              "matchCriteriaId": "47631DD2-0504-449D-9460-4D4233EAAEF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:731:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC2B8C19-4A66-44A8-9995-2BB71D8AA665",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:740:*:*:*:*:*:*:*",
              "matchCriteriaId": "07710B18-BF01-4316-A258-4F1CB6269C5E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:750:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3A631DA-1279-49AC-922E-7D7216DACC8D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:751:*:*:*:*:*:*:*",
              "matchCriteriaId": "65320F25-669B-40D8-A246-07B0202C00A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:753:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1C86F45-445E-4970-A378-199A35B23F4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:754:*:*:*:*:*:*:*",
              "matchCriteriaId": "74901A8A-A556-478F-ABCD-7DCFD471210A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:abap_platform:755:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B48E0FF-814F-4F9C-B5B1-87D978E1B4A4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (\u003e release 7.40).Because of this, an attacker can exploit these products via Code Injection, and potentially enabling to take complete control of the products, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the products to terminate."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota en SAP NetWeaver (servidor ABAP, versiones hasta 7.40) y la Plataforma ABAP (versiones posteriores a 7.40). Debido a esto, un atacante puede explotar estos productos por medio de una Inyecci\u00f3n de C\u00f3digo y potencialmente permitir tomar el control completo de los productos, incluyendo la visualizaci\u00f3n, el cambio o la eliminaci\u00f3n de datos mediante la inyecci\u00f3n de c\u00f3digo en la memoria de trabajo que es posteriormente ejecutada por la aplicaci\u00f3n.\u0026#xa0;Tambi\u00e9n puede ser usada para causar un fallo general en el producto, causando que los productos finalicen."
    }
  ],
  "id": "CVE-2020-6318",
  "lastModified": "2024-11-21T05:35:29.977",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "cna@sap.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-09T13:15:12.020",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2022/May/42"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2958563"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://seclists.org/fulldisclosure/2022/May/42"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2958563"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.