What is CVE-2020-6319?

CVE-2020-6319 is a medium-severity vulnerability in SAP Netweaver Application Server Java, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-10-15.

How severe is CVE-2020-6319?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Is CVE-2020-6319 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in SAP Netweaver Application Server Java

CVE-2020-6319

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal authentication information of the user, such as data relating to his or her current session and limitedly impact confidentiality and integrity of the application, leading to Reflected Cross Site Scripting.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.009 (56.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sap Netweaver_application_server_java — versions 7.10, 7.11, 7.20
Sap Se Netweaver Application Server Java — versions < 7.10, < 7.11, < 7.20

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

hsvhora/research_

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-6319?: CVE-2020-6319 is a medium-severity vulnerability in SAP Netweaver Application Server Java, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-10-15.
How severe is CVE-2020-6319?: Medium severity. CVSS v3 base score is 6.1 out of 10.
Is CVE-2020-6319 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.