SAP Security Patch Day — July 2020
Tuesday, 14 July 2020
Exploited 1
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
Critical 10.0
CVE-2020-6287 Exploited Public exploit SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without p…EPSS 95%
Public exploit code 1
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
All vulnerabilities 13
Critical1 ShowHide
-
Critical 10.0
CVE-2020-6287 Exploited Public exploit SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without p…EPSS 95%
High1 ShowHide
Medium10 ShowHide
- Medium 6.3
- Medium 6.1
- Medium 6.1
-
Medium 5.8
CVE-2020-6282 SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), ve…EPSS 1.1%
- Medium 5.4
- Medium 5.4
-
Medium 5.3
CVE-2020-6286 Public exploit The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40,…EPSS 24%
- Medium 4.6
- Medium 4.3
- Medium 4.2