Skip links

CVE-2020-6224 Information Disclosure in SAP NetWeaver Application Server Java (HTTP Service), SAP security note 2826528

Description

UPDATE 22nd December 2020: This note has been re-released with updated ‘Support Packages & Patches’ information. We have added SP 016 to the version J2EE ENGINE SERVERCORE 7.50.

Under certain conditions, SAP NetWeaver AS Java allows an attacker with administrative privileges to access information and user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to information disclosure.

Some well-known impacts of Information Disclosure are:

  • loss of information and system configuration confidentiality;
  • information gathering for further exploits and attacks.

Available fix and Supported packages

  • SERVERCORE | 7.10 | 7.10
  • SERVERCORE | 7.11 | 7.11
  • SERVERCORE | 7.20 | 7.20
  • SERVERCORE | 7.30 | 7.30
  • SERVERCORE | 7.31 | 7.31
  • SERVERCORE | 7.40 | 7.40
  • SERVERCORE | 7.50 | 7.50
  • J2EE ENGINE SERVERCORE 7.10 | SP024 | 000004
  • J2EE ENGINE SERVERCORE 7.10 | SP025 | 000000
  • J2EE ENGINE SERVERCORE 7.11 | SP019 | 000006
  • J2EE ENGINE SERVERCORE 7.11 | SP020 | 000000
  • J2EE ENGINE SERVERCORE 7.20 | SP009 | 000143
  • J2EE ENGINE SERVERCORE 7.30 | SP020 | 000004
  • J2EE ENGINE SERVERCORE 7.30 | SP021 | 000000
  • J2EE ENGINE SERVERCORE 7.31 | SP026 | 000003
  • J2EE ENGINE SERVERCORE 7.31 | SP027 | 000000
  • J2EE ENGINE SERVERCORE 7.40 | SP021 | 000003
  • J2EE ENGINE SERVERCORE 7.40 | SP022 | 000000
  • J2EE ENGINE SERVERCORE 7.50 | SP016 | 000032
  • J2EE ENGINE SERVERCORE 7.50 | SP017 | 000003
  • J2EE ENGINE SERVERCORE 7.50 | SP018 | 000000
  • J2EE ENGINE SERVERCORE 7.50 | SP019 | 000000

Affected component

    BC-JAS-WEB
    Web Container, HTTP, JavaMail, Servlets

CVSS

Score: 6.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2826528

TAGS

#Information-Exposure
#Information-Leak
#&160-CVE-2020-6224

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer

Initiating SAP Penetration Testing

►   Pentest, short for penetration testing, refers to a set of processes that simulate an attacker’s actions to identify security vulnerabilities. Companies

SAP Security Patch Day RedRays

May 2024 SAP Security Patch Day

Vulnerability: Multiple vulnerabilities in SAP CX Commerce SAP Component: CEC-SCC-PLA-PL CVE ID: CVE-2019-17495 CVSS Score: 9.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Category: Program error