{"api_version":"1","generated_at":"2026-04-22T23:30:35+00:00","cve":"CVE-2020-6248","urls":{"html":"https://cve.report/CVE-2020-6248","api":"https://cve.report/api/cve/CVE-2020-6248.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-6248","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-6248"},"summary":{"title":"CVE-2020-6248","description":"SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2020-05-12 18:15:00","updated_at":"2021-07-21 11:39:00"},"problem_types":["CWE-94","CWE-20"],"metrics":[],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","refsource":"MISC","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – May 2020 - Product Security Response at SAP - Community Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://launchpad.support.sap.com/#/notes/2917275","name":"https://launchpad.support.sap.com/#/notes/2917275","refsource":"MISC","tags":["Permissions Required"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6248","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6248","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"6248","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"adaptive_server_enterprise_backup_server","cpe6":"16.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"6248","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"adaptive_server_enterprise_backup_server","cpe6":"16.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-6248","ASSIGNER":"cna@sap.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"SAP SE","product":{"product_data":[{"product_name":"SAP Adaptive Server Enterprise (Backup Server)","version":{"version_data":[{"version_name":"<","version_value":"16.0"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection."}]},"impact":{"cvss":{"baseScore":"9.1","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Code Injection"}]}]},"references":{"reference_data":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","refsource":"MISC","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222"},{"url":"https://launchpad.support.sap.com/#/notes/2917275","refsource":"MISC","name":"https://launchpad.support.sap.com/#/notes/2917275"}]}},"nvd":{"publishedDate":"2020-05-12 18:15:00","lastModifiedDate":"2021-07-21 11:39:00","problem_types":["CWE-94","CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:adaptive_server_enterprise_backup_server:16.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"6248","Ordinal":"166501","Title":"CVE-2020-6248","CVE":"CVE-2020-6248","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"6248","Ordinal":"1","NoteData":"SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"6248","Ordinal":"2","NoteData":"2020-05-12","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"6248","Ordinal":"3","NoteData":"2020-05-12","Type":"Other","Title":"Modified"}]}}}