CVE-2020-6364

SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.

• CWE-78

• http://packetstormsecurity.com/files/163153/SAP-Wily-Introscope-Enterprise-OS-Command-Injection.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Jun/28Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2969828Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196Vendor Advisory
• http://packetstormsecurity.com/files/163153/SAP-Wily-Introscope-Enterprise-OS-Command-Injection.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Jun/28Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2969828Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196Vendor Advisory

Published

Oct 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6358SAP 3D Visual Enterprise Viewer, version - 9, allows a user …4.3
• CVE-2020-6359SAP 3D Visual Enterprise Viewer, version - 9, allows a user …4.3
• CVE-2020-6360SAP 3D Visual Enterprise Viewer, version - 9, allows a user …4.3
• CVE-2020-6361SAP 3D Visual Enterprise Viewer, version - 9, allows a user …4.3
• CVE-2020-6362SAP Banking Services version 500, use an incorrect authoriza…6.5
• CVE-2020-6363SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, expos…4.6
• CVE-2020-6365SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.…6.1
• CVE-2020-6366SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40,…6.5
• CVE-2020-6367There is a reflected cross site scripting vulnerability in S…6.1
• CVE-2020-6368SAP Business Planning and Consolidation, versions - 750, 751…5.4
• CVE-2020-6369SAP Solution Manager and SAP Focused Run (update provided in…5.9
• CVE-2020-6370SAP NetWeaver Design Time Repository (DTR), versions - 7.11,…4.8