CVE-2020-26825: XSS
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim's web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim's browser and the victim can easily close the browser tab to terminate it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26825?
CVE-2020-26825 is considered a medium severity vulnerability due to its potential for unauthorized code execution in SAP Fiori Launchpad.
How do I fix CVE-2020-26825?
To fix CVE-2020-26825, you should apply the latest security patches released by SAP for the affected versions of the Fiori Launchpad.
Who is affected by CVE-2020-26825?
CVE-2020-26825 affects users of SAP Fiori Launchpad versions 750 to 755 who utilize the News tile Application.
What impact does CVE-2020-26825 have?
The impact of CVE-2020-26825 allows attackers to send malicious code to end users through the News tile Application.
What is the nature of the vulnerability in CVE-2020-26825?
CVE-2020-26825 is caused by insufficient encoding of user-controlled inputs in the SAP Fiori Launchpad's News tile Application.