CVE-2020-6320 - SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted

Back Back to CVE browser

HIGH

SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted

Published Sep 9, 2020

8.1

HIGH

CVSS 3.1

EPSS 0.95%

Description

SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. Limited knowledge of payload is required for an attacker to exploit the vulnerability and perform tasks related to contact and interaction data which impacts Confidentiality and Integrity of data in the application.

Affected products

Vendor SAP SE Product SAP Marketing (Mobile Channel Servlet) Default
n/a
- Version
  < 130
  Status
  affected
  Constraints
  -
- Version
  < 140
  Status
  affected
  Constraints
  -
- Version
  < 150
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Marketing (Mobile Channel Servlet)

n/a

Version	Status	Constraints
< 130	affected	-
< 140	affected	-
< 150	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27470
Advisory
https://launchpad.support.sap.com/#/notes/2961991
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27470		Advisory
https://launchpad.support.sap.com/#/notes/2961991		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700		x_refsource_MISCVendor Advisory