CVE-2020-26835: XSS
SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be executed in the browser resulting in Reflected Cross-Site Scripting (XSS) vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26835?
CVE-2020-26835 is considered a medium severity vulnerability due to its potential to allow reflected cross-site scripting attacks.
How do I fix CVE-2020-26835?
To fix CVE-2020-26835, ensure your SAP NetWeaver AS ABAP version is updated to a patched release that addresses this specific vulnerability.
What are the consequences of exploiting CVE-2020-26835?
Exploiting CVE-2020-26835 can allow an attacker to execute malicious JavaScript in the context of a user's browser, leading to data theft or session hijacking.
Which versions of SAP are affected by CVE-2020-26835?
CVE-2020-26835 affects SAP NetWeaver AS ABAP versions 740, 750, 751, 752, 753, and 754.
Is there a workaround for CVE-2020-26835 if I cannot apply the patch immediately?
A potential workaround for CVE-2020-26835 includes implementing strict input validation on user-submitted URLs to mitigate risk until a patch can be applied.