Client-Side AngularJS Template Injection in SAP Commerce SmartEdit Extension
CVE-2020-6200

5.4MEDIUM

Key Information:

Vendor
SAP
Status
SAP Commerce Cloud (smartedit Extension)
Vendor
CVE Published:
10 March 2020

Summary

The SAP Commerce SmartEdit Extension, found in versions 6.6, 6.7, 1808, and 1811, is susceptible to a client-side angularjs template injection. This vulnerability allows attackers to exploit the templating capabilities of the Angular framework, potentially enabling unauthorized access to sensitive information or actions within the application. Organizations utilizing affected versions should implement necessary security measures to mitigate the risk associated with this vulnerability.

Affected Version(s)

SAP Commerce Cloud (SmartEdit Extension) < 6.6 < 6.6

SAP Commerce Cloud (SmartEdit Extension) < 6.7 < 6.7

SAP Commerce Cloud (SmartEdit Extension) < 1808 < 1808

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2876413
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.