Reflected Cross-Site Scripting Vulnerability in SAP NetWeaver and SAP S/4HANA
CVE-2020-6184

6.1MEDIUM

Key Information:

Vendor
SAP
Status
Automated Note Search Tool (SAP Basis)
Vendor
CVE Published:
12 February 2020

Summary

A reflected cross-site scripting vulnerability exists in SAP NetWeaver and SAP S/4HANA due to insufficient encoding of user-controlled inputs. This flaw could allow an attacker to inject malicious scripts into web pages viewed by other users, potentially compromising sensitive information and web applications. Users of the affected product versions should implement appropriate security measures to mitigate this risk.

Affected Version(s)

Automated Note Search Tool (SAP Basis) < 7.0 < 7.0

Automated Note Search Tool (SAP Basis) < 7.01 < 7.01

Automated Note Search Tool (SAP Basis) < 7.02 < 7.02

References

https://launchpad.support.sap.com/#/notes/2863397
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.