CVE-2020-6185: XSS

Published Feb 12, 2020

Updated

Under certain conditions ABAP Online Community in SAP NetWeaver (SAPBASIS version 7.40) and SAP S/4HANA (SAPBASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability.

Affected Software

6 affected components

SAP NetWeaver=7.40

SAP S\/4hana=7.50

SAP S\/4hana=7.51

SAP S\/4hana=7.52

SAP S\/4hana=7.53

SAP S\/4hana=7.54

Event History

Feb 12, 2020

CVE Published

via MITRE·07:56 PM

Data Sourced

via MITRE·07:56 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-6185?

CVE-2020-6185 is a Stored Cross Site Scripting vulnerability affecting ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54).

How does CVE-2020-6185 affect SAP NetWeaver?

CVE-2020-6185 affects SAP NetWeaver version 7.40 and allows an authenticated attacker to store a malicious payload, resulting in a Stored Cross Site Scripting vulnerability.

How does CVE-2020-6185 affect SAP S/4HANA?

CVE-2020-6185 affects SAP S/4HANA versions 7.50, 7.51, 7.52, 7.53, 7.54 and allows an authenticated attacker to store a malicious payload, resulting in a Stored Cross Site Scripting vulnerability.

What is the severity of CVE-2020-6185?

The severity of CVE-2020-6185 is medium with a CVSS score of 5.4.

How can I fix CVE-2020-6185?

To fix CVE-2020-6185, update SAP NetWeaver and SAP S/4HANA to the patched versions listed in the provided SAP notes.