VulnerabilityModified

CVE-2020-6318

HIGH 7.2EPSS 5.83%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Because of this, an attacker can exploit these products via Code Injection, and potentially enabling to take complete control of the products, including viewing, changing, or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the products to terminate.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 5.83% probability · 93th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: sap/abap platform
Source: cna@sap.com

References

http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2958563Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700Vendor Advisory
http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2958563Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.