CVE-2020-6326 - SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting

Back Back to CVE browser

MEDIUM

SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting

Published Sep 9, 2020

5.4

MEDIUM

CVSS 3.1

EPSS 0.65%

Description

SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting.

Affected products

Vendor SAP SE Product SAP NetWeaver (Knowledge Management) Default
n/a
- Version
  < 7.30
  Status
  affected
  Constraints
  -
- Version
  < 7.31
  Status
  affected
  Constraints
  -
- Version
  < 7.40
  Status
  affected
  Constraints
  -
- Version
  < 7.50
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP NetWeaver (Knowledge Management)

n/a

Version	Status	Constraints
< 7.30	affected	-
< 7.31	affected	-
< 7.40	affected	-
< 7.50	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27476
Advisory
https://launchpad.support.sap.com/#/notes/2953112
x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27476		Advisory
https://launchpad.support.sap.com/#/notes/2953112		x_refsource_MISCPermissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700		x_refsource_MISCVendor Advisory