Vulnerability · Published Dec 9, 2020 · Assigned by sap
CVE-2020-26835
Medium 5.3
In plain English
A medium-severity security flaw in SAP NetWeaver AS ABAP from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.0)5.3Medium
Exploit odds (30 days)0.8%top 42.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be executed in the browser resulting in Reflected Cross-Site Scripting (XSS) vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver AS ABAP | < 740< 750< 751< 752< 753< 754 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2996479 x_refsource_MISC