CVE-2020-6201 - The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting

Back Back to CVE browser

MEDIUM

The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting

Published Mar 10, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 0.80%

Description

The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting.

Affected products

Vendor SAP SE Product SAP Commerce Cloud (Testweb Extension) Default
n/a
- Version
  < 1808
  Status
  affected
  Constraints
  -
- Version
  < 1811
  Status
  affected
  Constraints
  -
- Version
  < 1905
  Status
  affected
  Constraints
  -
- Version
  < 6.6
  Status
  affected
  Constraints
  -
- Version
  < 6.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Commerce Cloud (Testweb Extension)

n/a

Version	Status	Constraints
< 1808	affected	-
< 1811	affected	-
< 1905	affected	-
< 6.6	affected	-
< 6.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27351
Advisory
https://launchpad.support.sap.com/#/notes/2876813
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27351		Advisory
https://launchpad.support.sap.com/#/notes/2876813		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305		x_refsource_MISCVendor Advisory