VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jun 10, 2020· Updated Jun 17, 2026

CVE-2020-6263

CVE-2020-6263

Description

Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; CORE-TOOLS 7.00, 7.01, 7.02, 7.05, 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not perform any authentication checks for operations that require user identity leading to Authentication Bypass.

Affected products

13
  • SAP/Netweaver Application Server Java11 versions
    cpe:2.3:a:sap:netweaver_application_server_java:7.00:*:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:sap:netweaver_application_server_java:7.00:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.01:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.02:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.05:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.11:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.20:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*
  • SAP/Netweaver As Javallm-fuzzy
  • SAP SE/SAP NetWeaver AS JAVAv5
    Range: < SAP-JEECOR 7.00

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.