PT-2020-19006 · Sap · Sap Netweaver As Abap+1

Published 2020-03-10 · Updated 2023-09-26 · CVE-2020-6205

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP BASIS versions 7.00 through 7.54

Description The issue arises from insufficient encoding of user-controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content, steal authentication information of the user, impersonate the user, and access all information with the same rights as the target user, leading to a Reflected Cross Site Scripting issue.

Recommendations For SAP BASIS versions 7.00 through 7.54, update to a version that sufficiently encodes user-controlled inputs to prevent Reflected Cross Site Scripting. As a temporary workaround, consider restricting access to user-controlled input fields until a patch is available. Avoid using sensitive information in user-controlled inputs until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6205

Affected Products

Sap Netweaver As Abap

Sap Basis

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6205 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6205 · Vendor Advisory
• https://t.me/cvenotify/58623 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2884910 · Note