TI-2020-05129 Aliases CVE-2020-6275 GHSA-m3x5-x584-4rhh

Server-side request forgery in SAP Netweaver AS ABAP

MEDIUM 45CWE-918Published 2020-06-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database.

Why it matters now

EPSS 0.01475 73rd percentileScored 2026-11-07

Fix Fixed SAP Netweaver AS ABAP (SAP SE): 700, 701, 702 +10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Netweaver AS ABAP	before 700; before 701; before 702; before 710; before 711; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754	700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754	Patch available	CNA

SAP Netweaver AS ABAP VendorSAP Affected before 700; before 701; before 702; before 710; before 711; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754 Fixed in 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754 Patch available CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_application_server_abap:700:::::::*	700	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:701:::::::*	701	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:702:::::::*	702	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:710:::::::*	710	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:711:::::::*	711	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:730:::::::*	730	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:731:::::::*	731	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:740:::::::*	740	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:::::::*	750	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:751:::::::*	751	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_application_server_abap:752:::::::*	752	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:::::::*	753	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:754:::::::*	754	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP

Remediation

Fix · CNA SAP Netweaver AS ABAP (SAP SE) Fixed in 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754

Timeline

2026-10-02 Threatist record created from CVE-2020-6275
2026-10-03 Alias added: GHSA-m3x5-x584-4rhh

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775

Other 1

https://launchpad.support.sap.com/#/notes/2912939

TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8

See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences