Lucene search

K
cve[email protected]CVE-2020-6213
HistoryApr 24, 2020 - 11:15 p.m.

CVE-2020-6213

2020-04-2423:15:11
CWE-79
web.nvd.nist.gov
91
sap
netweaver
abap
business server pages
xss
vulnerability
nvd
cve-2020-6213

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

36.1%

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL parameters as it does not sufficiently encode user controlled inputs.

Affected configurations

NVD
Node
sapnetweaver_as_abap_business_server_pagesMatch700
OR
sapnetweaver_as_abap_business_server_pagesMatch701
OR
sapnetweaver_as_abap_business_server_pagesMatch702
OR
sapnetweaver_as_abap_business_server_pagesMatch730
OR
sapnetweaver_as_abap_business_server_pagesMatch731
OR
sapnetweaver_as_abap_business_server_pagesMatch740
OR
sapnetweaver_as_abap_business_server_pagesMatch750
OR
sapnetweaver_as_abap_business_server_pagesMatch751
OR
sapnetweaver_as_abap_business_server_pagesMatch752
OR
sapnetweaver_as_abap_business_server_pagesMatch753
OR
sapnetweaver_as_abap_business_server_pagesMatch754

CNA Affected

[
  {
    "product": "SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT_PHTMLB)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 700"
      },
      {
        "status": "affected",
        "version": "< 701"
      },
      {
        "status": "affected",
        "version": "< 702"
      },
      {
        "status": "affected",
        "version": "< 730"
      },
      {
        "status": "affected",
        "version": "< 731"
      },
      {
        "status": "affected",
        "version": "< 740"
      },
      {
        "status": "affected",
        "version": "< 750"
      },
      {
        "status": "affected",
        "version": "< 751"
      },
      {
        "status": "affected",
        "version": "< 752"
      },
      {
        "status": "affected",
        "version": "< 753"
      },
      {
        "status": "affected",
        "version": "< 754"
      }
    ]
  }
]

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

36.1%

Related for CVE-2020-6213