XSS in SAP Netweaver Composite Application Framework
CVE-2020-6367
There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (53.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Sap Netweaver_composite_application_framework — versions 7.20, 7.30, 7.31
- Sap Se Netweaver Composite Application Framework — versions < 7.20, < 7.30, < 7.31
Weakness classification (CWE)
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-6367?
- CVE-2020-6367 is a medium-severity vulnerability in SAP Netweaver Composite Application Framework, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-10-20.
- How severe is CVE-2020-6367?
- Medium severity. CVSS v3 base score is 6.1 out of 10.