What’s Vulnerable › Vulnerabilities

CVE-2020-6304

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-14 · updated 2026-06-17
• Weakness: CWE-20

Description

Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.

Affected products

• SAP Netweaver Internet Communication Manager (Kernel): 7.21, 7.22, 7.49, 7.53
• SAP Netweaver Internet Communication Manager (Krnl32Nuc): 7.21, 7.21ext, 7.22, 7.22ext
• SAP Netweaver Internet Communication Manager (Krnl32Uc): 7.21, 7.21ext, 7.22, 7.22ext
• SAP Netweaver Internet Communication Manager (Krnl64Nuc): 7.21, 7.21ext, 7.22, 7.22ext, 7.49
• SAP Netweaver Internet Communication Manager (Krnl64Uc): 7.21, 7.21ext, 7.22, 7.22ext, 7.49

References

• https://launchpad.support.sap.com/#/notes/2848498
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771
• https://launchpad.support.sap.com/#/notes/2848498
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771

Get alerted when CVE-2020-6304 or the next vulnerability affects your stack