SAP has patched a critical vulnerability impacting the LM Configuration Wizard component in NetWeaver Application Server (AS) Java platform, allowing an unauthenticated attacker to take control of SAP applications.
The bug, dubbed RECON and tracked as CVE-2020-6287, is rated with a maximum CVSS score of 10 out of 10, potentially affecting over 40,000 SAP customers, according to cybersecurity firm Onapsis, which uncovered the flaw.
“If successfully exploited, a remote, unauthenticated attacker can obtain unrestricted access to SAP systems through the creation of high-privileged users and the execution of arbitrary operating system commands with the privileges of the SAP service user account, which has unrestricted access to the SAP database and is able to perform application maintenance activities, such as shutting down federated SAP applications,” the US Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory.
“The confidentiality, integrity, and availability of the data and processes hosted by the SAP application are at risk by this vulnerability,” it added.
The vulnerability is present by default in SAP applications running on top of SAP NetWeaver AS Java…
http://feedproxy.google.com/~r/TheHackersNews/~3/AT46X4fKSJo/sap-netweaver-vulnerability.html