TI-2020-05151 Aliases CVE-2020-6299 GHSA-r2rc-w6vq-wmhv

SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754…

LOW 22Published 2020-08-12 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given system using value help, leading to Information Disclosure.

Why it matters now

EPSS 0.00897 59th percentileScored 2026-11-07

Fix Fixed SAP NetWeaver (ABAP Server) and ABAP Platform (SAP SE): 740, 750, 751 +4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP NetWeaver (ABAP Server) and ABAP Platform	before 740; before 750; before 751; before 752; before 753; before 754; before 755	740, 750, 751, 752, 753, 754, 755	Patch available	CNA

SAP NetWeaver (ABAP Server) and ABAP Platform VendorSAP Affected before 740; before 750; before 751; before 752; before 753; before 754; before 755 Fixed in 740, 750, 751, 752, 753, 754, 755 Patch available CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:abap_platform:740:::::::*	740	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:750:::::::*	750	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:751:::::::*	751	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:753:::::::*	753	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:754:::::::*	754	Vulnerable	SAP
cpe:2.3:a:sap:abap_platform:755:::::::*	755	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:740:::::::*	740	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:::::::*	750	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:751:::::::*	751	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:::::::*	753	Vulnerable	SAP

cpe:2.3:a:sap:abap_platform:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
cpe:2.3:a:sap:abap_platform:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_application_server_abap:754:::::::*	754	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:755:::::::*	755	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP

Remediation

Fix · CNA SAP NetWeaver (ABAP Server) and ABAP Platform (SAP SE) Fixed in 740, 750, 751, 752, 753, 754, 755

Timeline

2026-10-02 Threatist record created from CVE-2020-6299
2026-10-03 Alias added: GHSA-r2rc-w6vq-wmhv

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552603345

Other 1

https://launchpad.support.sap.com/#/notes/2941510

TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
TI-2024-14732 Code Injection vulnerability in SAP ABA (Application Basis) CVSS 3.1CRITICAL 9.1
TI-2020-05148 SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730… CVSS 3.1HIGH 8.8
TI-2020-05170 Code injection in SAP NetWeaver and ABAP Platform CVSS 3.1HIGH 7.2
TI-2023-10915 SQL Injection vulnerability in SAP ABAP Platform CVSS 3.1MEDIUM 6.8
TI-2020-05039 Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS… CVSS 3.1MEDIUM 5.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences