{"id":"CVE-2020-6304","aliases":["EUVD-2020-27454","GHSA-86r6-3wmr-wv39"],"status":"published","title":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in...","description":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC \u0026 KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC \u0026 KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01483,"percentile":0.74159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2020-01-14T17:52:59Z","modified":"2026-06-17T03:23:02Z","products":[{"vendor":"sap","product":"netweaver_internet_communication_manager_\\(kernel\\)"},{"vendor":"sap","product":"netweaver_internet_communication_manager_\\(krnl32nuc\\)"},{"vendor":"sap","product":"netweaver_internet_communication_manager_\\(krnl32uc\\)"},{"vendor":"sap","product":"netweaver_internet_communication_manager_\\(krnl64nuc\\)"},{"vendor":"sap","product":"netweaver_internet_communication_manager_\\(krnl64uc\\)"},{"vendor":"sap se","product":"sap netweaver internet communication manager (kernel)"},{"vendor":"sap se","product":"sap netweaver internet communication manager (krnl32nuc)"},{"vendor":"sap se","product":"sap netweaver internet communication manager (krnl32uc)"},{"vendor":"sap se","product":"sap netweaver internet communication manager (krnl64nuc)"},{"vendor":"sap se","product":"sap netweaver internet communication manager (krnl64uc)"}],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2848498","tags":["x_refsource_MISC","x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6304"},{"url":"https://github.com/advisories/GHSA-86r6-3wmr-wv39"}],"sources":{"cve":[{"id":"CVE-2020-6304","description":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC \u0026 KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC \u0026 KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.","status":"published","published":"2020-01-14T17:52:59Z","modified":"2024-08-04T08:55:22.294Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:35:52.592504Z"}],"euvd":[{"id":"EUVD-2020-27454","description":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC \u0026 KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC \u0026 KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.","status":"published","published":"2020-01-14T17:52:59Z","modified":"2024-08-04T08:55:22Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:08:03.741202Z"}],"ghsa":[{"id":"GHSA-86r6-3wmr-wv39","title":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in...","description":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC \u0026 KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC \u0026 KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.","status":"published","published":"2022-05-24T17:06:11Z","modified":"2023-01-29T05:01:01Z","updated_at":"2026-11-02T14:44:43.584363Z"}],"nvd":[{"id":"CVE-2020-6304","description":"Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC \u0026 KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC \u0026 KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.","status":"published","published":"2020-01-14T18:15:11.883Z","modified":"2026-06-17T03:23:02.123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:05:52.385274Z"}]}}