{"id":"CVE-2020-6287","published":"2020-07-14T13:15:13Z","modified":"2026-06-17T03:23:00Z","title":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","vendor":"SAP","product":"NetWeaver","tier":"core","eol":null,"description":{"text":"SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.","provenance":"source","from":"NVD"},"summary":{"text":"A missing authentication check in the LM Configuration Wizard component of SAP NetWeaver AS JAVA lets unauthenticated actors reach configuration functions that should be protected. An attacker with network access to the system needs no credentials and no user interaction, and can use these functions to carry out critical actions, including creating an administrative user.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:40Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.94719,"percentile":0.99857,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-6287","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-04-08","exploitedFirstSeen":"2021-04-08","ransomware":false,"evidence":[{"url":"https://digital.nhs.uk/cyber-alerts/2021/cc-3815","date":"2021-04-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.csoonline.com/article/3674119/most-common-sap-vulnerabilities-attackers-try-to-exploit.html","date":"2022-09-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2020-6287","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2020-6287","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2020-6287","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2020-6287","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2020-6287","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2020-6287","date":"2024-01-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-31&host_type=src&vulnerability=cve-2020-6287","date":"2024-01-31"}],"evidenceTotal":587,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2021/Apr/6","tags":["Mailing List","Third Party Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2934135","tags":["Permissions Required","Vendor Advisory"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.onapsis.com/recon-sap-cyber-security-vulnerability","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2021/Apr/6","tags":["Mailing List","Third Party Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2934135","tags":["Permissions Required","Vendor Advisory"]},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.onapsis.com/recon-sap-cyber-security-vulnerability","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6287","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated exploitation of public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"does not perform an authentication check which allows an attacker without prior authentication","start":84,"end":178}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: creates admin account enabling persistent valid access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"the ability to create an administrative user","start":277,"end":321}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-27437","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27437","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2020-07-15","earliestUrl":"https://github.com/chipik/SAP_RECON","repos":[{"name":"chipik/SAP_RECON","url":"https://github.com/chipik/SAP_RECON","stars":223,"created":"2020-07-15"},{"name":"duc-nt/CVE-2020-6287-exploit","url":"https://github.com/duc-nt/CVE-2020-6287-exploit","stars":96,"created":"2020-07-20"},{"name":"Onapsis/CVE-2020-6287_RECON-scanner","url":"https://github.com/Onapsis/CVE-2020-6287_RECON-scanner","stars":28,"created":"2020-07-21"},{"name":"murataydemir/CVE-2020-6287","url":"https://github.com/murataydemir/CVE-2020-6287","stars":13,"created":"2020-08-13"},{"name":"ynsmroztas/CVE-2020-6287-Sap-Add-User","url":"https://github.com/ynsmroztas/CVE-2020-6287-Sap-Add-User","stars":2,"created":"2020-07-22"}]},"metasploit":[{"name":"SAP Unauthenticated WebService User Creation","module":"auxiliary/admin/sap/cve_2020_6287_ws_add_user","type":"auxiliary","disclosureDate":"2020-07-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/cve_2020_6287_ws_add_user.rb"}],"nuclei":[{"id":"CVE-2020-6287","name":"SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition","severity":"critical","path":"http/cves/2020/CVE-2020-6287.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6287.yaml"}],"first":{"date":"2020-07-14","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/cve_2020_6287_ws_add_user.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2020-07-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6287","provenance":"source"},{"date":"2020-07-14","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2020-07-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/sap/cve_2020_6287_ws_add_user.rb","provenance":"source"},{"date":"2021-04-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://digital.nhs.uk/cyber-alerts/2021/cc-3815","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27437","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":477},"priority":{"score":70.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2030 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}