SAP security note 2941315, "[CVE-2020-6309] Missing Authentication check in SAP NetWeaver AS JAVA", is a program error note released on 13.10.2020. Below are the symptom and SAP recommended solution.
Description
Symptom
UPDATE 13th October 2020: This note has been re-released with updated 'Support Packages & Patches' information.
- For the release ESI – WSRM 7.11, we added the Patch level 000001 under SP019.
- For the release ENGINEAPI 7.10, we added the Patch level 000007 under SP024.
SAP NetWeaver application exposes a web service which does not perform any authentication checks leading to complete denial of service.
Solution
Update to the latest available patch level as mentioned in the note.
CVSS
Score 7.5 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Full note on SAP: SAP Support Launchpad note 2941315
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].