CVE-2020-6310: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2020-6310 is a security vulnerability affecting SAP NetWeaver (ABAP Server) and ABAP Platform, versions 702, 730, 731, 740, and 750. The vulnerability was discovered in the SOA Configuration Trace component and was disclosed in January 2020. The issue allows any authenticated user to enumerate all SAP users, leading to potential information disclosure (NVD).

The vulnerability stems from improper access control mechanisms in the SOA Configuration Trace component. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability requires network access and low privileges to exploit, with no user interaction needed, and results in low confidentiality impact (NVD).

The primary impact of this vulnerability is the unauthorized disclosure of information. Specifically, it allows authenticated users to enumerate all SAP users in the system, which could potentially be used for further targeted attacks or unauthorized access attempts (NVD).

The vulnerability requires an authenticated user account to exploit, making it relatively contained in terms of potential attack surface. The low attack complexity (AC:L) indicates that no special conditions or circumstances are required for exploitation (NVD).

SAP has released security patches to address this vulnerability. Users are advised to refer to SAP Security Note 2944988 for detailed mitigation instructions (SAP Note).