« Volver al listado

CVE-2020-6187

Estado: ModificadaMedia (4.9)—

SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver Guided Procedures

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6187",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP NetWeaver (Guided Procedures)",
          "versions": [
            {
              "status": "affected",
              "version": "= 7.10"
            },
            {
              "status": "affected",
              "version": "= 7.11"
            },
            {
              "status": "affected",
              "version": "= 7.20"
            },
            {
              "status": "affected",
              "version": "= 7.30"
            },
            {
              "status": "affected",
              "version": "= 7.31"
            },
            {
              "status": "affected",
              "version": "= 7.40"
            },
            {
              "status": "affected",
              "version": "= 7.50"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-12T20:15:14.307",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2864415",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2864415",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver (Guided Procedures), versiones 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, no comprueba suficientemente la entrada de un documento XML de un administrador comprometido, conllevando a una Denegación de Servicio."
    }
  ],
  "lastModified": "2026-06-17T03:22:50.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_guided_procedures:7.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06CA0A75-184C-42FC-A1FD-19545165A380"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_guided_procedures:7.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8675178-A73D-49C7-BD5D-85431EF9912C"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_guided_procedures:7.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21D40F4E-E064-4120-99EE-5108094F768A"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_guided_procedures:7.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "402FF7B9-8F4D-48D4-917B-C22A1AA03CB3"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_guided_procedures:7.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68707EF8-8FD7-42C1-B5D0-223B716EDB9C"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_guided_procedures:7.40:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC69EB62-C662-468B-9490-CF72210F5A55"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_guided_procedures:7.50:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2B90227-A617-4C0D-B787-FF989B3BA12D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}