PT-2020-19007 · Sap · Sap Cloud Platform Integration For Data Services

Published 2020-03-10 · Updated 2020-03-12 · CVE-2020-6206

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Cloud Platform Integration for Data Services version 1.0

Description The issue allows user inputs to be reflected as error or warning messages, potentially misleading victims into following malicious instructions inserted by external attackers, leading to Cross Site Request Forgery.

Recommendations For SAP Cloud Platform Integration for Data Services version 1.0, consider implementing input validation and sanitization to prevent malicious instructions from being reflected in error or warning messages. As a temporary workaround, restrict the ability of external attackers to insert malicious instructions into user inputs until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-6206

Affected Products

Sap Cloud Platform Integration For Data Services

References · 4

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6206 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6206 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2859004 · Note