Description

SAP NetWeaver AS JAVA (LM Configuration Wizard) does not perform an authentication check which allows an attacker to execute configuration tasks to perform critical actions against the SAP Java system.

Remediation

Install SAP security patches #2934135, #2939665.

References

SAP RECON PoC from chipik

SAP Security Patch Day – July 2020

Related Vulnerabilities

MongoDb Improper Authentication Vulnerability (CVE-2015-7882)

OSGi Management Console Default Credentials

WordPress Improper Authentication Vulnerability (CVE-2022-43504)

CubeCart Improper Authentication Vulnerability (CVE-2014-2341)

ZenCart Improper Authentication Vulnerability (CVE-2009-2255)

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A

Tags

Insecure Admin Access