Vulnerability · Published Apr 14, 2020 · Assigned by sap
CVE-2020-6229
Medium 6.1
In plain English
A medium-severity security flaw in SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.0)6.1Medium
Exploit odds (30 days)0.7%top 48.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not sufficiently encode user controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME) | < 700< 701< 702< 710< 711< 730< 731< 740 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2900374 x_refsource_MISC