CVE-2020-6224

Severity: medium (CVSS 6.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-14 · updated 2026-06-17
Weakness: CWE-532

Description

SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to Information Disclosure.

Affected products

SAP NetWeaver AS Java: 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 (+1)

References

https://launchpad.support.sap.com/#/notes/2826528
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202
https://launchpad.support.sap.com/#/notes/2826528
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

Get alerted when CVE-2020-6224 or the next vulnerability affects your stack