PT-2020-19002 · Sap · Sap Commerce

Published 2020-03-10 · Updated 2020-03-12 · CVE-2020-6201

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Commerce (Testweb Extension) versions 6.6, 6.7, 1808, 1811, 1905

Description The issue arises from insufficient encoding of user-controlled inputs. Certain GET URL parameters are reflected in the HTTP responses without proper escaping or sanitization, leading to Reflected Cross Site Scripting.

Recommendations For versions 6.6, 6.7, 1808, 1811, 1905, ensure that user-controlled inputs are properly encoded and sanitized to prevent Reflected Cross Site Scripting. As a temporary workaround, consider restricting access to sensitive GET URL parameters until a proper fix is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6201

Affected Products

Sap Commerce

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6201 · Security Note
• https://t.me/cvenotify/1506 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2876813 · Note