CVE-2020-6282: 
SAP NetWeaver Application Server Java vulnerability analysis and mitigation

CVE-2020-6282 is a Server-Side Request Forgery (SSRF) vulnerability affecting SAP NetWeaver AS JAVA (IIOP service) versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. The vulnerability was disclosed in July 2020 as part of SAP's July 2020 Patch Day (SAP Advisory, SecurityWeek).

The vulnerability allows an attacker to send crafted requests from a vulnerable web application to target internal systems behind firewalls that are normally inaccessible from the external network. The vulnerability has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N (NVD).

The vulnerability primarily affects the confidentiality of the system, allowing attackers to access internal systems that should not be accessible from external networks. The CVSS scoring indicates that while the vulnerability can be exploited remotely with low complexity and requires no privileges or user interaction, it only results in low confidentiality impact with no effect on integrity or availability (NVD).

The vulnerability can be exploited remotely with low attack complexity and requires no special privileges or user interaction. It is particularly concerning as it can be used to target internal systems that are typically protected by firewalls (NVD).

SAP has released security patches to address this vulnerability as part of their July 2020 Patch Day. Organizations using affected versions of SAP NetWeaver AS JAVA should apply the available security updates (SAP Advisory).