TI-2020-05096 Aliases CVE-2020-6240 GHSA-r5cx-qg2w-4jw8

SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and…

LOW 36Published 2020-05-12 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service leading to Denial of Service

Why it matters now

EPSS 0.01421 73rd percentileScored 2026-11-07

Fix Fixed SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI) (SAP SE): 750, 752, 753 +1SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS) (SAP SE): 700, 710, 730 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI)	before 750; before 752; before 753; before 754	750, 752, 753, 754	Patch available	CNA
SAP	SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS)	before 700; before 710; before 730; before 731; before 804	700, 710, 730, 731, 804	Patch available	CNA

SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI) VendorSAP Affected before 750; before 752; before 753; before 754 Fixed in 750, 752, 753, 754 Patch available CNA
SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS) VendorSAP Affected before 700; before 710; before 730; before 731; before 804 Fixed in 700, 710, 730, 731, 804 Patch available CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_application_server_abap:700:::::::*	700	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:710:::::::*	710	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:730:::::::*	730	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:731:::::::*	731	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:::::::*	750	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:752:::::::*	752	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:::::::*	753	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:754:::::::*	754	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:804:::::::*	804	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:804:*:*:*:*:*:*:* Versions 804 Vulnerable ·SAP

Remediation

Fix · CNA SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_UI) (SAP SE) Fixed in 750, 752, 753, 754
Fix · CNA SAP NetWeaver AS ABAP (Web Dynpro ABAP) (SAP_BASIS) (SAP SE) Fixed in 700, 710, 730, 731, 804

Timeline

2026-10-02 Threatist record created from CVE-2020-6240
2026-10-03 Alias added: GHSA-r5cx-qg2w-4jw8

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222

Other 1

https://launchpad.support.sap.com/#/notes/2856923

TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8

See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences