Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2020-6286

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unau

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP SE SAP NetWeaver AS JAVA (LM Configuration Wizard)

  • < 7.30affected
  • < 7.31affected
  • < 7.40affected
  • < 7.50affected

References