What is CVE-2020-6190?

CVE-2020-6190 is a medium-severity vulnerability in SAP Netweaver Application Server Java, classified under Information Disclosure. CVSS score: 5.8/10. Published 2020-02-12.

How severe is CVE-2020-6190?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Information disclosure in SAP Netweaver Application Server Java

CVE-2020-6190

Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure.

Vulnerability class: Information Disclosure

EPSS: 0.009 (55.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

Affected products

Sap Netweaver_application_server_java — versions 7.30, 7.31, 7.40
Sap Se Netweaver As Java (Heap Dump Application) — versions = 7.30, = 7.31, = 7.40

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-6190?: CVE-2020-6190 is a medium-severity vulnerability in SAP Netweaver Application Server Java, classified under Information Disclosure. CVSS score: 5.8/10. Published 2020-02-12.
How severe is CVE-2020-6190?: Medium severity. CVSS v3 base score is 5.8 out of 10.