What is CVE-2020-6275?

CVE-2020-6275 is a critical-severity vulnerability in Sap Netweaver_application_server_abap, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.8/10. Published 2020-06-10.

How severe is CVE-2020-6275?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2020-6275 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Sap Netweaver_application_server_abap

CVE-2020-6275

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names…

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.014 (70.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sap Netweaver_application_server_abap — versions 700, 701, 702
Sap Se Netweaver As Abap — versions < 700, < 701, < 702

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2020-6275

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-6275?: CVE-2020-6275 is a critical-severity vulnerability in Sap Netweaver_application_server_abap, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.8/10. Published 2020-06-10.
How severe is CVE-2020-6275?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-6275 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.