Skip links

CVE-2020-6287 Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard), SAP security note 2934135

Description

UPDATE 28th July 2020: This note has been re-released with updated ‘Solution’ information. We changed the note text in the workaround statement mentioned. There have not been any changes done which require customer action.

This SAP security note addresses vulnerabilities identified in LM Configuration Wizard of SAP NetWeaver AS JAVA. The vulnerability details along with their CVE relevant information can be found below.

1. Missing Authentication

LM Configuration Wizard of SAP NetWeaver AS JAVA, does not perform an authentication check which allows an attacker without prior authentication, to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system.

  • CVE-2020-6287 
  • CVSS Score: 10.0; CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

2. Path Traversal

The insufficient input path validation of certain parameter in the web service, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory.

  • CVE-2020-6286 
  • CVSS Score: 5.3; CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Available fix and Supported packages

  • LMCTC | 7.30 | 7.30
  • LMCTC | 7.31 | 7.31
  • LMCTC | 7.40 | 7.40
  • LMCTC | 7.50 | 7.50
  • LM CONFIGURATION WIZARD 7.30 | SP019 | 000001
  • LM CONFIGURATION WIZARD 7.30 | SP020 | 000001
  • LM CONFIGURATION WIZARD 7.30 | SP021 | 000000
  • LM CONFIGURATION WIZARD 7.31 | SP023 | 000001
  • LM CONFIGURATION WIZARD 7.31 | SP024 | 000001
  • LM CONFIGURATION WIZARD 7.31 | SP025 | 000001
  • LM CONFIGURATION WIZARD 7.31 | SP026 | 000001
  • LM CONFIGURATION WIZARD 7.31 | SP027 | 000000
  • LM CONFIGURATION WIZARD 7.31 | SP028 | 000000
  • LM CONFIGURATION WIZARD 7.40 | SP018 | 000001
  • LM CONFIGURATION WIZARD 7.40 | SP019 | 000001
  • LM CONFIGURATION WIZARD 7.40 | SP020 | 000001
  • LM CONFIGURATION WIZARD 7.40 | SP021 | 000001
  • LM CONFIGURATION WIZARD 7.40 | SP022 | 000000
  • LM CONFIGURATION WIZARD 7.40 | SP023 | 000000
  • LM CONFIGURATION WIZARD 7.50 | SP012 | 000002
  • LM CONFIGURATION WIZARD 7.50 | SP013 | 000003
  • LM CONFIGURATION WIZARD 7.50 | SP014 | 000002
  • LM CONFIGURATION WIZARD 7.50 | SP015 | 000002
  • LM CONFIGURATION WIZARD 7.50 | SP016 | 000002

Affected component

    BC-INS-CTC
    Central technical configuration

CVSS

Score: 10.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2934135

TAGS

#Broken-authentication
#&160-CTC
#LM-Configuration-Wizard
#&160-tc&126-lm&126-ctc&126-cul&126-startup_app
#vulnerabilities
#CTCWebService
#Central-Technical-Configuration-Wizard
#CVE-2020-6287&160
#&160-CVE-2020-6286