Cross-Site Scripting Vulnerability in SAP Business Objects Business Intelligence Platform

CVE-2020-6220

What is CVE-2020-6220?

The SAP Business Objects Business Intelligence Platform, specifically the BI Launchpad and CMC components, has a vulnerability that arises from the inadequate encoding of user-controlled inputs. This results in the potential for Cross-Site Scripting (XSS) attacks, which can only be exploited when the bttoken in the victim's session remains active. Users should be aware of the risks associated with this vulnerability and consider implementing security measures to protect their systems.

References