Cross-Site Scripting Vulnerability in SAP NetWeaver DTR
CVE-2020-6370

4.8MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver (di Design Time Repository)
Vendor
CVE Published:
20 October 2020

What is CVE-2020-6370?

The SAP NetWeaver Design Time Repository (DTR) has a vulnerability that arises from inadequate encoding of user-controlled inputs. This allows malicious actors to inject and execute arbitrary scripts in the context of unsuspecting users' browsers. As a result, compromised sessions and theft of sensitive information can occur, highlighting the importance of applying security updates and ensuring input validation across all affected versions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SAP NetWeaver (DI Design Time Repository) < 7.11 < 7.11

SAP NetWeaver (DI Design Time Repository) < 7.30 < 7.30

SAP NetWeaver (DI Design Time Repository) < 7.31 < 7.31

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2939419
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.