Lucene search

[email protected]CVE-2020-6324

HistorySep 09, 2020 - 2:15 p.m.

CVE-2020-6324

2020-09-0914:15:12

CWE-79

[email protected]

web.nvd.nist.gov

sap

netweaver

as abap

bsp

test application

sbspext_table

cve-2020-6324

reflected cross site scripting

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.8%

JSON

SAP Netweaver AS ABAP(BSP Test Application sbspext_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send polluted URL to the victim, when the victim clicks on this URL, the attacker can read, modify the information available in the victim�s browser leading to Reflected Cross Site Scripting.

Affected configurations

NVD

Node

sapnetweaver_as_abap_business_server_pagesMatch700

sapnetweaver_as_abap_business_server_pagesMatch701

sapnetweaver_as_abap_business_server_pagesMatch702

sapnetweaver_as_abap_business_server_pagesMatch730

sapnetweaver_as_abap_business_server_pagesMatch731

sapnetweaver_as_abap_business_server_pagesMatch740

sapnetweaver_as_abap_business_server_pagesMatch750

sapnetweaver_as_abap_business_server_pagesMatch751

sapnetweaver_as_abap_business_server_pagesMatch752

sapnetweaver_as_abap_business_server_pagesMatch753

sapnetweaver_as_abap_business_server_pagesMatch754

sapnetweaver_as_abap_business_server_pagesMatch755

CPENameOperatorVersion
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq700
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq701
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq702
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq730
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq731
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq740
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq750
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq751
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq752
sap:netweaver_as_abap_business_server_pagessap netweaver as abap business server pageseq753

CPE	Name	Operator	Version
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	700
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	701
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	702
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	730
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	731
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	740
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	750
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	751
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	752
sap:netweaver_as_abap_business_server_pages	sap netweaver as abap business server pages	eq	753

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "product": "SAP NetWeaver AS ABAP (BSP Test Application)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 700"
      },
      {
        "status": "affected",
        "version": "< 701"
      },
      {
        "status": "affected",
        "version": "< 702"
      },
      {
        "status": "affected",
        "version": "< 730"
      },
      {
        "status": "affected",
        "version": "< 731"
      },
      {
        "status": "affected",
        "version": "< 740"
      },
      {
        "status": "affected",
        "version": "< 750"
      },
      {
        "status": "affected",
        "version": "< 751"
      },
      {
        "status": "affected",
        "version": "< 752"
      },
      {
        "status": "affected",
        "version": "< 753"
      },
      {
        "status": "affected",
        "version": "< 754"
      },
      {
        "status": "affected",
        "version": "< 755"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2948239

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.8%

JSON

Related for CVE-2020-6324

cvelist1 prion1 nvd1