CVE-2020-6203

CRITICAL

SAP NetWeaver UDDI Server - Path Traversal

Title source: llm
STIX 2.1

Description

SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs, leading to Path Traversal.

References (2)

Core 2
Core References
Permissions Required x_refsource_misc
https://launchpad.support.sap.com/#/notes/2806198

Scores

CVSS v3 9.1
EPSS 0.0098
EPSS Percentile 77.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-22
Status published
Products (7)
sap/netweaver 7.10
sap/netweaver 7.11
sap/netweaver 7.20
sap/netweaver 7.30
sap/netweaver 7.31
sap/netweaver 7.40
sap/netweaver 7.50
Published Mar 10, 2020
Tracked Since Feb 18, 2026