PT-2020-19001 · Google+1 · Angularjs+1

Published 2020-03-10 · Updated 2020-03-11 · CVE-2020-6200

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Commerce (SmartEdit Extension) versions 6.6, 6.7, 1808, 1811

Description The issue is related to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that exploits the templating facilities of the angular framework.

Recommendations For versions 6.6, 6.7, 1808, 1811, consider disabling the angularjs template injection functionality until a patch is available. Restrict access to the templating facilities of the angular framework to minimize the risk of exploitation. Avoid using the vulnerable angularjs template injection in the affected SAP Commerce (SmartEdit Extension) until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6200

Affected Products

Angularjs

Sap Commerce

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6200 · Security Note
• https://t.me/cvenotify/1505 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2876413 · Note