PT-2020-19099 · Sap · Sap Netweaver

Published 2020-09-09 · Updated 2020-09-14 · CVE-2020-6326

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver (Knowledge Management) versions 7.30 through 7.50

Description The issue allows an authenticated attacker to create malicious links in the UI. When clicked by a victim, these links will execute arbitrary Java scripts, thus extracting or modifying information otherwise restricted, leading to Stored Cross Site Scripting.

Recommendations For versions 7.30 through 7.50, update to a version that includes the fix for this issue to prevent Stored Cross Site Scripting attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6326

Affected Products

Sap Netweaver

References · 4

• https://osv.dev/vulnerability/CVE-2020-6326 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6326 · Security Note
• https://launchpad.support.sap.com/#/notes/2953112 · Note