CVE-2020-6286

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40…

Medium · published July 14, 2020

CVSS v3.0

5.3

EPSS

28%

Percentile

98.1

In the wild

Unconfirmed

What it is

The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.

The record

Technical detail

CVSS v3.0: 5.3 · MEDIUM
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.28312 · 98.1th percentile
Published: 2020-07-14T12:30Z

EPSS history

Timeline

14 JUL 12:30Z
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40…
cvelistv5