What is CVE-2020-6262?

CVE-2020-6262 is a high-severity vulnerability in SAP Application Server, classified under Code Injection. CVSS score: 8.8/10. Published 2020-05-12.

How severe is CVE-2020-6262?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in SAP Application Server

CVE-2020-6262

Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.012 (64.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sap Application_server — versions 740, 2008_1_46c, 2008_1_620
Sap Se Application Server Abap (St-pi) — versions < 2008_1_46C, < 2008_1_620, < 2008_1_640

Weakness classification (CWE)

CWE-94 — Code Injection

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-6262?: CVE-2020-6262 is a high-severity vulnerability in SAP Application Server, classified under Code Injection. CVSS score: 8.8/10. Published 2020-05-12.
How severe is CVE-2020-6262?: High severity. CVSS v3 base score is 8.8 out of 10.