{"id":"CVE-2020-6304","state":"PUBLISHED","title":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, ","description":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.","publishedAt":"2020-01-14T17:52:59.000Z","updatedAt":"2024-08-04T08:55:22.294Z","severity":{"score":5.9,"label":"Medium","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"sap"},"assigner":"sap","products":["SAP SE SAP NetWeaver Internet Communication Manager (KRNL32NUC)","SAP SE SAP NetWeaver Internet Communication Manager (KRNL32UC)","SAP SE SAP NetWeaver Internet Communication Manager (KRNL64NUC)","SAP SE SAP NetWeaver Internet Communication Manager (KRNL64UC)","SAP SE SAP NetWeaver Internet Communication Manager (KERNEL)"],"affected":[{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KRNL32NUC)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.21EXT","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.22EXT","status":"affected"}]},{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KRNL32UC)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.21EXT","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.22EXT","status":"affected"}]},{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KRNL64NUC)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.21EXT","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.22EXT","status":"affected"},{"version":"< 7.49","status":"affected"}]},{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KRNL64UC)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.21EXT","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.22EXT","status":"affected"},{"version":"< 7.49","status":"affected"}]},{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KERNEL)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.49","status":"affected"},{"version":"< 7.53","status":"affected"}]}],"references":["https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771","https://launchpad.support.sap.com/#/notes/2848498"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:38.312Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/6xxx/CVE-2020-6304.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-6304","state":"PUBLISHED","datePublished":"2020-01-14T17:52:59.000Z","dateUpdated":"2024-08-04T08:55:22.294Z","assignerShortName":"sap","assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","dateReserved":"2020-01-08T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service."}],"affected":[{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KRNL32NUC)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.21EXT","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.22EXT","status":"affected"}]},{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KRNL32UC)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.21EXT","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.22EXT","status":"affected"}]},{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KRNL64NUC)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.21EXT","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.22EXT","status":"affected"},{"version":"< 7.49","status":"affected"}]},{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KRNL64UC)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.21EXT","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.22EXT","status":"affected"},{"version":"< 7.49","status":"affected"}]},{"vendor":"SAP SE","product":"SAP NetWeaver Internet Communication Manager (KERNEL)","versions":[{"version":"< 7.21","status":"affected"},{"version":"< 7.22","status":"affected"},{"version":"< 7.49","status":"affected"},{"version":"< 7.53","status":"affected"}]}],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771","tags":["x_refsource_CONFIRM"]},{"url":"https://launchpad.support.sap.com/#/notes/2848498","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Improper Input Validation","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"sap","dateUpdated":"2020-01-14T17:52:59.000Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cna@sap.com","ID":"CVE-2020-6304","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"SAP NetWeaver Internet Communication Manager (KRNL32NUC)","version":{"version_data":[{"version_name":"<","version_value":"7.21"},{"version_name":"<","version_value":"7.21EXT"},{"version_name":"<","version_value":"7.22"},{"version_name":"<","version_value":"7.22EXT"}]}},{"product_name":"SAP NetWeaver Internet Communication Manager (KRNL32UC)","version":{"version_data":[{"version_name":"<","version_value":"7.21"},{"version_name":"<","version_value":"7.21EXT"},{"version_name":"<","version_value":"7.22"},{"version_name":"<","version_value":"7.22EXT"}]}},{"product_name":"SAP NetWeaver Internet Communication Manager (KRNL64NUC)","version":{"version_data":[{"version_name":"<","version_value":"7.21"},{"version_name":"<","version_value":"7.21EXT"},{"version_name":"<","version_value":"7.22"},{"version_name":"<","version_value":"7.22EXT"},{"version_name":"<","version_value":"7.49"}]}},{"product_name":"SAP NetWeaver Internet Communication Manager (KRNL64UC)","version":{"version_data":[{"version_name":"<","version_value":"7.21"},{"version_name":"<","version_value":"7.21EXT"},{"version_name":"<","version_value":"7.22"},{"version_name":"<","version_value":"7.22EXT"},{"version_name":"<","version_value":"7.49"}]}},{"product_name":"SAP NetWeaver Internet Communication Manager (KERNEL)","version":{"version_data":[{"version_name":"<","version_value":"7.21"},{"version_name":"<","version_value":"7.22"},{"version_name":"<","version_value":"7.49"},{"version_name":"<","version_value":"7.53"}]}}]},"vendor_name":"SAP SE"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service."}]},"impact":{"cvss":{"baseScore":"5.9","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper Input Validation"}]}]},"references":{"reference_data":[{"name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771","refsource":"CONFIRM","url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771"},{"name":"https://launchpad.support.sap.com/#/notes/2848498","refsource":"MISC","url":"https://launchpad.support.sap.com/#/notes/2848498"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://launchpad.support.sap.com/#/notes/2848498","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T08:55:22.294Z"}}]}}}