CVE-2020-6184: XSS

Published Feb 12, 2020

Updated

Under certain conditions, ABAP Online Community in SAP NetWeaver (SAPBASIS version 7.40) and SAP S/4HANA (SAPBASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability.

Affected Software

6 affected components

SAP NetWeaver=7.40

SAP S\/4hana=7.50

SAP S\/4hana=7.51

SAP S\/4hana=7.52

SAP S\/4hana=7.53

SAP S\/4hana=7.54

Event History

Feb 12, 2020

CVE Published

via MITRE·07:46 PM

Data Sourced

via MITRE·07:46 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-6184?

CVE-2020-6184 is a Reflected Cross-Site Scripting (XSS) vulnerability in ABAP Online Community in SAP NetWeaver and SAP S/4HANA.

What is the severity of CVE-2020-6184?

The severity of CVE-2020-6184 is medium.

Which software versions are affected by CVE-2020-6184?

CVE-2020-6184 affects SAP NetWeaver (SAP_BASIS version 7.40), and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54).

How does CVE-2020-6184 impact the affected software?

CVE-2020-6184 allows attackers to execute malicious scripts in the context of a user's browser, potentially leading to unauthorized actions or phishing attacks.

Is there a fix available for CVE-2020-6184?

Yes, SAP has released security notes and patches to address CVE-2020-6184. Please refer to the official SAP support portal for more information.