CVE-2020-6317: 
SAP Adaptive Server Enterprise vulnerability analysis and mitigation

CVE-2020-6317 is an information disclosure vulnerability affecting SAP Adaptive Server Enterprise (ASE) versions 15.7 and 16.0. The vulnerability was discovered and disclosed in 2020, where an attacker with regular user credentials and local access to an ASE cockpit installation could access sensitive information present in the installation log files (NVD).

The vulnerability is classified as an information disclosure issue related to the insertion of sensitive information into log files (CWE-532). It has been assigned a CVSS v3.1 Base Score of 3.5 (LOW) with the vector string CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. SAP's own assessment rated it slightly lower at 2.6 (LOW) with the vector CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows access to sensitive information in installation log files. However, the accessed information, while sensitive, is of limited utility and cannot be used to further access, modify, or render unavailable any other information in the cockpit or system (NVD).

The vulnerability requires an attacker to have regular user credentials and local access to an ASE cockpit installation. The attack complexity is considered low according to the CVSS score, but privileged access is required to exploit the vulnerability (NVD).

SAP has released security patches to address this vulnerability. Users should apply the relevant security updates provided in SAP Security Note 2953203 (SecurityWeek).

The vulnerability was rated as low severity by both SAP and NVD, receiving limited attention in the security community due to its restricted impact and exploitation requirements (Trustwave).