What is CVE-2020-6243?

CVE-2020-6243 is a high-severity vulnerability in SAP Adaptive Server Enterprise, classified under Code Injection. CVSS score: 8.8/10. Published 2020-05-12.

How severe is CVE-2020-6243?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in SAP Adaptive Server Enterprise

CVE-2020-6243

Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessary checks for an authenticated user while executing the extended stored procedure, allowing an attacker to read, modify, delete restricted data on connected servers, leading to Code Injection.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.009 (55.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sap Adaptive_server_enterprise — versions 15.7, 16.0
Sap Se Adaptive Server Enterprise (Xp On Windows Platform) — versions < 15.7, < 16.0

Weakness classification (CWE)

CWE-94 — Code Injection

References

cna@sap.com (Permissions Required, x_refsource_MISC)
cna@sap.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-6243?: CVE-2020-6243 is a high-severity vulnerability in SAP Adaptive Server Enterprise, classified under Code Injection. CVSS score: 8.8/10. Published 2020-05-12.
How severe is CVE-2020-6243?: High severity. CVSS v3 base score is 8.8 out of 10.