CVE-2020-6181 : Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP

Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability.

Published 2020-02-12 20:15:14

Updated 2020-02-21 13:55:45

Source SAP SE

View at NVD, CVE.org

Products affected by CVE-2020-6181

SAP » Netweaver » Version: 7.02
cpe:2.3:a:sap:netweaver:7.02:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver » Version: 7.30
cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver » Version: 7.40
cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*
Matching versions
SAP » Netweaver » Version: 7.31
cpe:2.3:a:sap:netweaver:7.31:*:*:*:*:*:*:*
Matching versions
SAP » Abap Platform » Version: 7.50
cpe:2.3:a:sap:abap_platform:7.50:*:*:*:*:*:*:*
Matching versions
SAP » Abap Platform » Version: 7.51
cpe:2.3:a:sap:abap_platform:7.51:*:*:*:*:*:*:*
Matching versions
SAP » Abap Platform » Version: 7.52
cpe:2.3:a:sap:abap_platform:7.52:*:*:*:*:*:*:*
Matching versions
SAP » Abap Platform » Version: 7.53
cpe:2.3:a:sap:abap_platform:7.53:*:*:*:*:*:*:*
Matching versions
SAP » Abap Platform » Version: 7.54
cpe:2.3:a:sap:abap_platform:7.54:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-6181

Top countries where our scanners detected CVE-2020-6181

Top open port discovered on systems with this issue 8000

IPs affected by CVE-2020-6181 460

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-6181!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-6181

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 38 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-6181

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.8	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N	3.9	1.4	SAP SE
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: Low Availability: None
5.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: Low Availability: None

References for CVE-2020-6181

https://launchpad.support.sap.com/#/notes/2880744

SAP ONE Support Launchpad: Log On
Permissions Required;Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812

SAP Security Patch Day – February 2020 - Product Security Response at SAP - Community Wiki
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-6181

Products affected by CVE-2020-6181

Threat overview for CVE-2020-6181

Exploit prediction scoring system (EPSS) score for CVE-2020-6181

CVSS scores for CVE-2020-6181

References for CVE-2020-6181