PT-2020-19050 · Sap · Sap Enterprise Threat Detection

Published 2020-05-12 · Updated 2020-05-15 · CVE-2020-6254

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Enterprise Threat Detection versions 1.0 through 2.0

Description The issue arises from insufficient encoding of error response pages, allowing XSS payload reflection in the response. This leads to reflected Cross Site Scripting, where an attacker can inject malicious scripts into the response, potentially executing them on the victim's browser.

Recommendations For SAP Enterprise Threat Detection versions 1.0 through 2.0, update to a version that properly encodes error response pages to prevent XSS payload reflection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6254

Affected Products

Sap Enterprise Threat Detection

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-6254 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6254 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2913293 · Note