{"id":"CVE-2020-6287","kind":"vulnerability","aliases":["CVE-2020-6287"],"related":[],"title":"SAP NetWeaver: SAP NetWeaver Missing Authentication for Critical Function Vulnerability","description":"SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.","summary":"SAP NetWeaver Application Server Java has a missing authentication check on a critical function, so anyone who can reach the server can run configuration tasks without logging in. An attacker can use it to create administrative users, which is the basis of the 'Recon' or 'Bizarre' SAP NetWeaver takeover campaigns.","severity":"critical","cvss":10.0,"epss":0.94719,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"SAP NetWeaver","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","netweaver","sap","vendor"],"not_affected_if":["abap-only-stack"],"how_to_check":null,"fix":"Apply the SAP security note for CVE-2020-6287 per vendor instructions, as CISA requires.","status":"open","published_at":"2020-07-14T13:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:43:27+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:43:27Z","model":"claude-haiku-5-5","output":{"fix":"Apply the SAP security note for CVE-2020-6287 per vendor instructions, as CISA requires.\nunknown","reach":"network","impact":"high","summary":"SAP NetWeaver Application Server Java has a missing authentication check on a critical function, so anyone who can reach the server can run configuration tasks without logging in. An attacker can use it to create administrative users, which is the basis of the 'Recon' or 'Bizarre' SAP NetWeaver takeover campaigns.","category":"vendor","who_cares":["sap","netweaver","java"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker creates admin users and takes over the SAP server","analyst_note":"Find the SAP security note number and affected Java component versions at https://www.cisa.gov/known-exploited-vulnerabilities-catalog and SAP support portal; sources gave no version or check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["abap-only-stack"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2848,"output_tokens":390,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the SAP security note number and affected Java component versions at https://www.cisa.gov/known-exploited-vulnerabilities-catalog and SAP support portal; sources gave no version or check.","search":"'-2020':12A,15A '-6287':13A,16A '7.30':82C '7.31':83C '7.40':84C '7.50':85C 'abil':114C 'action':106C 'administr':59B,118C 'allow':93C 'anyon':39B 'applic':26B 'attack':53B,95C 'authent':6A,32B,90C,98C,133C 'avail':126C 'basi':64B 'bizarr':69B 'campaign':73B 'check':33B,91C,134C 'compromis':122C 'confidenti':123C 'configur':47B,79C,101C 'creat':58B,116C 'critic':8A,36B,105C 'cve':11A,14A 'execut':100C 'exploit':19B 'function':9A,37B 'includ':112C 'integr':124C 'java':20B,28B,77C,110C 'lead':130C 'lm':78C 'log':50B 'miss':5A,31B,132C 'netweav':2A,4A,21B,25B,71B,75C 'netweaver':18A 'perform':88C,104C 'prior':97C 'reach':42B 'recon':67B 'run':46B 'sap':1A,3A,17A,22B,24B,70B,74C,109C 'server':27B,44B 'system':111C,129C 'takeov':72B 'task':48B,102C 'therefor':121C 'use':55B 'user':60B,119C 'vendor':23B 'version':81C 'vulner':10A 'without':49B,96C 'wizard':80C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-07-14T13:15:13+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-6287","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-6287","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:42+00:00","note":null},{"source":"epss","external_id":"CVE-2020-6287","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-6287","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-6287","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6287","severity":null,"published_at":"2020-07-14T13:15:13+00:00","modified_at":"2026-06-17T03:23:00+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}