CVE-2020-6287

SAP NetWeaver allowed unauthenticated attackers to execute critical configuration tasks and create administrative users.

SAP NetWeaver Application Server Java Platforms lacked authentication for critical functions, enabling unauthenticated access to execute configuration tasks and create administrative users. This failure is critical for DIB organizations because it allows attackers to escalate privileges and compromise the system without needing valid credentials, directly impacting compliance with access control requirements. Organizations must ensure all SAP NetWeaver instances are patched and monitored for unauthorized administrative user creation.

Shame score — A missing authentication flaw allowing unauthenticated administrative user creation is a severe, avoidable security failure that directly enables privilege escalation and system compromise.