PT-2020-1563 · Sap · Sap Process Integration

Published 2020-01-14 · Updated 2020-01-21 · CVE-2020-6305

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP Process Integration versions prior to the updates provided in SAP XIAF 7.31, 7.40, 7.50

Description The issue is related to insufficient protection of the web page structure in the REST adapter of the SAP Process Integration platform. This can allow a remote attacker to perform cross-site scripting (XSS) attacks.

Recommendations For versions prior to the updates provided in SAP XIAF 7.31, 7.40, 7.50, update to the respective version or later to resolve the issue. As a temporary workaround, consider restricting user-controlled inputs to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-00564

CVE-2020-6305

Affected Products

Sap Process Integration

References · 5

• https://osv.dev/vulnerability/CVE-2020-6305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6305 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00564 · Security Note
• https://launchpad.support.sap.com/#/notes/2863743 · Note