CVE-2020-6263 - Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass

Back Back to CVE browser

CRITICAL

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass

Published Jun 10, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.44%

Description

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass.

Affected products

Vendor SAP SE Product SAP NetWeaver AS JAVA Default
n/a
- Version
  < 7.01
  Status
  affected
  Constraints
  -
- Version
  < 7.01 SERVERCOR 7.10
  Status
  affected
  Constraints
  -
- Version
  < 7.02
  Status
  affected
  Constraints
  -
- Version
  < 7.05
  Status
  affected
  Constraints
  -
- Version
  < 7.10
  Status
  affected
  Constraints
  -
- Version
  < 7.11
  Status
  affected
  Constraints
  -
- Version
  < 7.20
  Status
  affected
  Constraints
  -
- Version
  < 7.30
  Status
  affected
  Constraints
  -
- Version
  < 7.31
  Status
  affected
  Constraints
  -
- Version
  < 7.40
  Status
  affected
  Constraints
  -
- Version
  < 7.50
  Status
  affected
  Constraints
  -
- Version
  < 7.50 CORE-TOOLS 7.00
  Status
  affected
  Constraints
  -
- Version
  < SAP-JEECOR 7.00
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP NetWeaver AS JAVA

n/a

Version	Status	Constraints
< 7.01	affected	-
< 7.01 SERVERCOR 7.10	affected	-
< 7.02	affected	-
< 7.05	affected	-
< 7.10	affected	-
< 7.11	affected	-
< 7.20	affected	-
< 7.30	affected	-
< 7.31	affected	-
< 7.40	affected	-
< 7.50	affected	-
< 7.50 CORE-TOOLS 7.00	affected	-
< SAP-JEECOR 7.00	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (2)

https://launchpad.support.sap.com/#/notes/2878568
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://launchpad.support.sap.com/#/notes/2878568		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Jun 10, 2020

Updated Aug 4, 2024

Reserved Jan 8, 2020

Link CVE-2020-6263

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-6263

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-6263