PT-2020-19141 · Sap · Sap Business Planning/Consolidation

Published 2020-10-15 · Updated 2020-10-19 · CVE-2020-6368

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Business Planning and Consolidation versions 100, 200, 750, 751, 752, 753, 754, 755, 810

Description The issue allows an attacker to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users, leading to Cross Site Scripting.

Recommendations For versions 100, 200, 750, 751, 752, 753, 754, 755, 810, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-6368

Affected Products

Sap Business Planning/Consolidation

References · 4

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6368 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6368 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2960825 · Note