Read the docs
TI-2020-05222 Aliases CVE-2020-6371GHSA-6r75-5qh9-j928

User enumeration vulnerability can be exploited to get a list of user accounts and…

Priority LOW 22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server ABAP (POWL test application) versions - 710, 711, 730, 731, 740, 750, leading to Information Disclosure.

Why it matters now

EPSS 0.00897 59th percentileScored 2026-11-07
Fix Fixed SAP NetWeaver Application Server ABAP (POWL test application) (SAP SE): 710, 711, 730 +3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP NetWeaver Application Server ABAP (POWL test application)before 710; before 711; before 730; before 731; before 740; before 750710, 711, 730, 731, 740, 750Patch availableCNA
  • SAP NetWeaver Application Server ABAP (POWL test application) VendorSAP Affected before 710; before 711; before 730; before 731; before 740; before 750 Fixed in 710, 711, 730, 731, 740, 750 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:*710VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:*711VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:*730VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:*731VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:*740VulnerableSAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:*750VulnerableSAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP NetWeaver Application Server ABAP (POWL test application) (SAP SE) Fixed in 710, 711, 730, 731, 740, 750

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6371
  2. 2026-10-03 Alias added: GHSA-6r75-5qh9-j928

References

Advisory 2

  • TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
  • TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
  • TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
  • TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
  • TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences