What is CVE-2020-6254?

CVE-2020-6254 is a medium-severity vulnerability in SAP Enterprise Threat Detection, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-05-12.

How severe is CVE-2020-6254?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in SAP Enterprise Threat Detection

CVE-2020-6254

SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.007 (47.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sap Enterprise_threat_detection — versions 1.0, 2.0
Sap Se Enterprise Threat Detection — versions < 1.0, < 2.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-6254?: CVE-2020-6254 is a medium-severity vulnerability in SAP Enterprise Threat Detection, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-05-12.
How severe is CVE-2020-6254?: Medium severity. CVSS v3 base score is 6.1 out of 10.