Stored Cross-Site Scripting Vulnerability in SAP NetWeaver Knowledge Management
CVE-2020-6326
5.4MEDIUM
Key Information:
- Vendor
- SAP
- Vendor
- CVE Published:
- 9 September 2020
Summary
The Stored Cross-Site Scripting vulnerability in SAP NetWeaver Knowledge Management versions 7.30, 7.31, 7.40, and 7.50 allows authenticated attackers to create malicious links within the user interface. When these links are clicked by unsuspecting users, they can execute arbitrary JavaScript code, which can lead to unauthorized data extraction or modification of restricted information. This security flaw underscores the importance of securing user input and ensuring that user-generated content is properly sanitized.
Affected Version(s)
SAP NetWeaver (Knowledge Management) < 7.30 < 7.30
SAP NetWeaver (Knowledge Management) < 7.31 < 7.31
SAP NetWeaver (Knowledge Management) < 7.40 < 7.40
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved