CVE-2020-6309: 
SAP NetWeaver Application Server Java vulnerability analysis and mitigation

CVE-2020-6309 is a high-severity vulnerability affecting SAP NetWeaver AS JAVA versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50, specifically in components including EngineAPI, WSRM, ServerCore, and J2EE-FRMW. The vulnerability was disclosed in August 2020 and involves a missing authentication check for a web service that could allow attackers to perform unauthorized actions (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The flaw is characterized by a missing authentication check for a web service, which allows an attacker to send several payloads without requiring any authentication (NVD).

The primary impact of this vulnerability is the potential for complete denial of service. An unauthenticated attacker can exploit this vulnerability to send multiple payloads that could lead to service disruption (Bleeping Computer)

The vulnerability is remotely exploitable and requires no authentication, making it particularly dangerous. The attack complexity is rated as low, indicating that exploitation is straightforward once the vulnerability is discovered (NVD).

SAP has released patches to address this vulnerability as part of their August 2020 security updates. Customers are advised to apply the relevant security patches through the SAP Support Launchpad (Bleeping Computer).