Lucene search

SapCVE-2020-6184

HistoryFeb 12, 2020 - 8:15 p.m.

CVE-2020-6184

2020-02-1220:15:13

CWE-79

sap

web.nvd.nist.gov

sap

netweaver

s/4hana

xss

vulnerability

abap

online community

sap_basis

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

36.1%

JSON

Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability.

Affected configurations

Nvd

Node

sapnetweaverMatch7.40

saps\/4hanaMatch7.50

saps\/4hanaMatch7.51

saps\/4hanaMatch7.52

saps\/4hanaMatch7.53

saps\/4hanaMatch7.54

VendorProductVersionCPE
sapnetweaver7.40cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*
saps\/4hana7.50cpe:2.3:a:sap:s\/4hana:7.50:*:*:*:*:*:*:*
saps\/4hana7.51cpe:2.3:a:sap:s\/4hana:7.51:*:*:*:*:*:*:*
saps\/4hana7.52cpe:2.3:a:sap:s\/4hana:7.52:*:*:*:*:*:*:*
saps\/4hana7.53cpe:2.3:a:sap:s\/4hana:7.53:*:*:*:*:*:*:*
saps\/4hana7.54cpe:2.3:a:sap:s\/4hana:7.54:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sap	netweaver	7.40	cpe:2.3:a:sap:netweaver:7.40:::::::*
sap	s\/4hana	7.50	cpe:2.3:a:sap:s\/4hana:7.50:::::::*
sap	s\/4hana	7.51	cpe:2.3:a:sap:s\/4hana:7.51:::::::*
sap	s\/4hana	7.52	cpe:2.3:a:sap:s\/4hana:7.52:::::::*
sap	s\/4hana	7.53	cpe:2.3:a:sap:s\/4hana:7.53:::::::*
sap	s\/4hana	7.54	cpe:2.3:a:sap:s\/4hana:7.54:::::::*

CNA Affected

[
  {
    "product": "Automated Note Search Tool (SAP Basis)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.0"
      },
      {
        "status": "affected",
        "version": "< 7.01"
      },
      {
        "status": "affected",
        "version": "< 7.02"
      },
      {
        "status": "affected",
        "version": "< 7.31"
      },
      {
        "status": "affected",
        "version": "< 7.4"
      },
      {
        "status": "affected",
        "version": "< 7.5"
      },
      {
        "status": "affected",
        "version": "< 7.51"
      },
      {
        "status": "affected",
        "version": "< 7.52"
      },
      {
        "status": "affected",
        "version": "< 7.53"
      },
      {
        "status": "affected",
        "version": "< 7.54"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2863397

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

36.1%

JSON

Related for CVE-2020-6184