Vulnerability · Published Mar 10, 2020 · Assigned by sap

CVE-2020-6205

Medium 6.1

In plain English

A medium-severity security flaw in SAP NetWeaver Application Server ABAP (Smart Forms) - SAP_BASIS from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.0)6.1Medium

Exploit odds (30 days)0.8%top 44.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content and/or steal authentication information of the user and/or impersonate the user and access all information with the same rights as the target user, leading to Reflected Cross Site Scripting Vulnerability.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP NetWeaver Application Server ABAP (Smart Forms) - SAP_BASIS	< 7.00< 7.01< 7.02< 7.10< 7.11< 7.30< 7.31< 7.40

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2884910 x_refsource_MISC