Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
SAP NetWeaver RECON CVE-2020-6287 - Vulnerability Database

SAP NetWeaver RECON CVE-2020-6287

Description

SAP NetWeaver AS JAVA (LM Configuration Wizard) does not perform an authentication check which allows an attacker to execute configuration tasks to perform critical actions against the SAP Java system.

Remediation

Install SAP security patches #2934135, #2939665.

References

SAP RECON PoC from chipik
SAP Security Patch Day – July 2020

Related Vulnerabilities

VirtueMart access control bypass High
Common tags: Insecure Admin Access Known Vulnerabilities
Apache APISIX default token (CVE-2020-13945/CVE-2022-24112) Medium
Common tags: Insecure Admin Access Known Vulnerabilities
ColdFusion administrator login page publicly available Low
Common tags: Insecure Admin Access
PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2019-9641) Critical
Common tags: Known Vulnerabilities
Apache Traffic Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-9518) High
Common tags: Known Vulnerabilities

Severity

High

Classification

CVE-2020-6287
CWE-287
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A

Tags

Insecure Admin Access
Known Vulnerabilities