{"api_version":"1","generated_at":"2026-04-23T05:05:03+00:00","cve":"CVE-2020-6191","urls":{"html":"https://cve.report/CVE-2020-6191","api":"https://cve.report/api/cve/CVE-2020-6191.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-6191","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-6191"},"summary":{"title":"CVE-2020-6191","description":"SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2020-02-12 20:15:00","updated_at":"2020-02-19 17:13:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812","refsource":"MISC","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – February 2020 - Product Security Response at SAP - Community Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://launchpad.support.sap.com/#/notes/2878030","name":"https://launchpad.support.sap.com/#/notes/2878030","refsource":"MISC","tags":["Permissions Required","Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6191","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6191","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"6191","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"landscape_management","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"6191","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"landscape_management","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-6191","ASSIGNER":"cna@sap.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"SAP SE","product":{"product_data":[{"product_name":"SAP Landscape Management","version":{"version_data":[{"version_name":"=","version_value":"3.0"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation."}]},"impact":{"cvss":{"baseScore":"7.2","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Missing input validation"}]}]},"references":{"reference_data":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812","refsource":"MISC","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"},{"url":"https://launchpad.support.sap.com/#/notes/2878030","refsource":"MISC","name":"https://launchpad.support.sap.com/#/notes/2878030"}]}},"nvd":{"publishedDate":"2020-02-12 20:15:00","lastModifiedDate":"2020-02-19 17:13:00","problem_types":["CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":9},"severity":"HIGH","exploitabilityScore":8,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:landscape_management:3.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"6191","Ordinal":"166444","Title":"CVE-2020-6191","CVE":"CVE-2020-6191","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"6191","Ordinal":"1","NoteData":"SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"6191","Ordinal":"2","NoteData":"2020-02-12","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"6191","Ordinal":"3","NoteData":"2020-02-12","Type":"Other","Title":"Modified"}]}}}