Description

SAP NetWeaver AS JAVA (LM Configuration Wizard) does not perform an authentication check which allows an attacker to execute configuration tasks to perform critical actions against the SAP Java system.

Remediation

Install SAP security patches #2934135, #2939665.

References

SAP RECON PoC from chipik

SAP Security Patch Day – July 2020

Related Vulnerabilities

WordPress Improper Input Validation Vulnerability (CVE-2020-28037)

Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-4042)

WebLogic CVE-2023-22108 Vulnerability (CVE-2023-22108)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-19995)

Moodle Improper Input Validation Vulnerability (CVE-2022-35650)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A

Tags

Insecure Admin Access Known Vulnerabilities CWE-287 CVE-2020-6287