Vulnerability · Published Oct 20, 2020 · Assigned by sap

CVE-2020-6367

High 8.2

In plain English

A high-severity security flaw in SAP NetWeaver Composite Application Framework from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.0)8.2High

Exploit odds (30 days)0.8%top 42.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP NetWeaver Composite Application Framework	< 7.20< 7.30< 7.31< 7.40< 7.50

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2972661 x_refsource_MISC