CVE-2020-6181
First published: Wed Feb 12 2020(Updated: )
Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP ABAP Platform | =7.50 | |
| SAP ABAP Platform | =7.51 | |
| SAP ABAP Platform | =7.52 | |
| SAP ABAP Platform | =7.53 | |
| SAP ABAP Platform | =7.54 | |
| SAP NetWeaver | =7.02 | |
| SAP NetWeaver | =7.30 | |
| SAP NetWeaver | =7.31 | |
| SAP NetWeaver | =7.40 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-6181.
What is the severity of CVE-2020-6181?
The severity of CVE-2020-6181 is medium, with a CVSS score of 5.8.
Which versions of SAP NetWeaver and SAP ABAP Platform are affected?
SAP NetWeaver versions 7.02, 7.30, 7.31, 7.40, and SAP ABAP Platform versions 7.50, 7.51, 7.52, 7.53, 7.54 are affected.
What is the issue with the SAML SSO implementation in SAP NetWeaver and SAP ABAP Platform?
Under certain circumstances, the SAML SSO implementation in SAP NetWeaver and SAP ABAP Platform allows an attacker to include invalidated data in the HTTP response header, leading to HTTP response manipulation.
How can I fix the vulnerability CVE-2020-6181?
To fix the vulnerability CVE-2020-6181, it is recommended to apply the relevant SAP Security Note and update your SAP NetWeaver and SAP ABAP Platform installations to the latest available patch levels.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sap
- canonical/sap abap platform
- version/sap abap platform/7.50
- version/sap abap platform/7.51
- version/sap abap platform/7.52
- version/sap abap platform/7.53
- version/sap abap platform/7.54
- canonical/sap netweaver
- version/sap netweaver/7.02
- version/sap netweaver/7.30
- version/sap netweaver/7.31
- version/sap netweaver/7.40