CVE-2020-6243

8HIGH

Key Information:

Vendor
SAP
Status
SAP Adaptive Server Enterprise (xp Server On Windows Platform)
Vendor
CVE Published:
12 May 2020

Summary

Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection.

Affected Version(s)

SAP Adaptive Server Enterprise (XP Server on Windows Platform) < 15.7 < 15.7

SAP Adaptive Server Enterprise (XP Server on Windows Platform) < 16.0 < 16.0

References

https://launchpad.support.sap.com/#/notes/2915585
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.