What is CVE-2020-6253?

CVE-2020-6253 is a high-severity vulnerability in SAP Adaptive Server Enterprise, classified under SQL Injection. CVSS score: 7.2/10. Published 2020-05-12.

How severe is CVE-2020-6253?

High severity. CVSS v3 base score is 7.2 out of 10.

SQL Injection in SAP Adaptive Server Enterprise

CVE-2020-6253

Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafted database queries to elevate their privileges, modify database objects, or execute commands they are not otherwise authorized to execute, leading to SQL Injection.

Vulnerability class: SQL Injection

EPSS: 0.012 (66.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sap Adaptive_server_enterprise — versions 15.7, 16.0
Sap Se Adaptive Server Enterprise (Web Services) — versions < 15.7, < 16.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-6253?: CVE-2020-6253 is a high-severity vulnerability in SAP Adaptive Server Enterprise, classified under SQL Injection. CVSS score: 7.2/10. Published 2020-05-12.
How severe is CVE-2020-6253?: High severity. CVSS v3 base score is 7.2 out of 10.