Lucene search

SapCVE-2020-6177

HistoryFeb 12, 2020 - 8:15 p.m.

CVE-2020-6177

2020-02-1220:15:13

CWE-20

sap

web.nvd.nist.gov

sap

mobile platform

cve-2020-6177

xml

validation

vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

32.4%

JSON

SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server.

Affected configurations

Nvd

Node

sapmobile_platformMatch3.0

VendorProductVersionCPE
sapmobile_platform3.0cpe:2.3:a:sap:mobile_platform:3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	mobile_platform	3.0	cpe:2.3:a:sap:mobile_platform:3.0:::::::*

CNA Affected

[
  {
    "product": "SAP Mobile Platform",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "= 3.0"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2880993

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

32.4%

JSON

Related for CVE-2020-6177