CVE-2020-6287

CVE-2020-6287 is a missing authentication check (CWE-306) in the LM Configuration Wizard component of SAP NetWeaver Application Server Java versions 7.30, 7.31, 7.40 and 7.50. An unauthenticated remote attacker can reach the configuration interface over the network and execute critical configuration tasks without any credentials. This allows the attacker to create administrative users and take full control of the SAP Java system, compromising its confidentiality, integrity and availability. Any organization running SAP NetWeaver AS Java on the affected versions is exposed, especially instances where the LM Configuration Wizard is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, carries a 94.7% EPSS probability of exploitation within 30 days, and news reports describe mission-critical SAP applications under active attack.

What to do: Apply SAP's security updates for NetWeaver AS Java 7.30, 7.31, 7.40 and 7.50 per the vendor's instructions (patches were released in July 2020), prioritizing internet-facing systems given the CISA KEV listing. As an interim mitigation, restrict network access to or disable the LM Configuration Wizard on affected systems. Also audit the system for unexpected or newly created administrative users and review access logs for unauthenticated configuration requests.