There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.
References
| Link | Resource |
|---|---|
| https://launchpad.support.sap.com/#/notes/2972661 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 | Vendor Advisory |
| https://launchpad.support.sap.com/#/notes/2972661 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://launchpad.support.sap.com/#/notes/2972661 - Permissions Required, Vendor Advisory | |
| References | () https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 - Vendor Advisory |
Information
Published : 2020-10-20 14:15
Updated : 2024-11-21 05:35
NVD link : CVE-2020-6367
Mitre link : CVE-2020-6367
CVE.ORG link : CVE-2020-6367
JSON object : View
Products Affected
sap
- netweaver_composite_application_framework
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')