CVE-2020-6286: 
SAP NetWeaver Application Server Java vulnerability analysis and mitigation

The SAP NetWeaver AS JAVA vulnerability (CVE-2020-6286), also known as RECON, was discovered in early 2020. This critical vulnerability affects the LM Configuration Wizard component in SAP NetWeaver AS JAVA versions 7.30, 7.31, 7.40, and 7.50. The flaw allows unauthenticated attackers to exploit a method to download zip files to specific directories, leading to path traversal issues (CERT-EU, NVD).

The vulnerability stems from insufficient input path validation of certain parameters in the web service of SAP NetWeaver AS JAVA's LM Configuration Wizard. It received a critical CVSS score of 10.0, indicating maximum severity. The flaw affects a default component present in every SAP application running the SAP NetWeaver Java technology stack, including SAP S/4HANA Java, SAP SCM, SAP CRM, SAP Enterprise Portal, and SAP Solution Manager (CERT-EU).

If successfully exploited, the vulnerability allows attackers to obtain unrestricted access to SAP systems through the creation of high-privileged users. The attacker can execute arbitrary operating system commands with the privileges of the SAP service user account (adm), which has unrestricted access to the SAP database and can perform application maintenance activities (CERT-EU).

Proof-of-concept exploit code became publicly available within days of the vulnerability's disclosure, and active scanning for vulnerable systems was observed in the wild. The vulnerability requires no authentication to exploit, making it particularly dangerous (BleepingComputer).

SAP released security patches to address this vulnerability through Security Note #2934135. Given the critical nature of the vulnerability and the availability of public exploits, immediate patching was strongly recommended for affected systems (CERT-EU).