CVE-2020-6275 : What You Need to Know

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable to a Server Side Request Forgery Attack that can compromise the SAP database's confidentiality, integrity, and availability.

Understanding CVE-2020-6275

This CVE involves a vulnerability in SAP Netweaver AS ABAP that allows attackers to perform a Server Side Request Forgery (SSRF) attack.

What is CVE-2020-6275?

SAP Netweaver AS ABAP versions 700 to 754 are susceptible to an SSRF attack, enabling malicious actors to manipulate the import/export functionality to coerce the web server into communicating with a server under the attacker's control.

The Impact of CVE-2020-6275

The vulnerability poses a high risk, with a CVSS base score of 7.6, affecting confidentiality, integrity, and availability of the SAP database.

Technical Details of CVE-2020-6275

This section delves into the specific technical aspects of the CVE.

Vulnerability Description

The vulnerability allows attackers to use inappropriate path names with malicious server names to trick the web server into authenticating with the malicious server, potentially compromising the SAP database.

Affected Systems and Versions

SAP Netweaver AS ABAP versions < 700 to < 754

Exploitation Mechanism

Attack Complexity: High
Attack Vector: Adjacent Network
Privileges Required: High
User Interaction: None
Scope: Changed

Mitigation and Prevention

Protecting systems from CVE-2020-6275 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply relevant patches and updates from SAP
Monitor and restrict network access to vulnerable systems
Implement strong access controls and authentication mechanisms

Long-Term Security Practices

Regularly update and patch SAP systems
Conduct security assessments and penetration testing
Educate users and administrators on security best practices

Patching and Updates

Refer to SAP's security notes 2912939 for specific patching instructions