CVE-2020-6210: XSS

Published Mar 10, 2020

Updated

SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, leading to reflected Cross-Site Scripting (XSS) vulnerability.

Affected Software

2 affected components

SAP Fiori Launchpad=753

SAP Fiori Launchpad=754

Event History

Mar 10, 2020

CVE Published

via MITRE·08:21 PM

Data Sourced

via MITRE·08:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-6210?

CVE-2020-6210 is classified as a medium severity vulnerability due to its potential to lead to reflected Cross-Site Scripting (XSS).

How do I fix CVE-2020-6210?

To fix CVE-2020-6210, ensure that your SAP Fiori Launchpad is updated to a version that properly encodes user-controlled inputs.

What versions of SAP Fiori Launchpad are affected by CVE-2020-6210?

CVE-2020-6210 affects SAP Fiori Launchpad versions 753 and 754.

What type of vulnerability is CVE-2020-6210?

CVE-2020-6210 is a reflected Cross-Site Scripting (XSS) vulnerability that can be exploited through user-controlled input.

Can an attacker exploit CVE-2020-6210 without authentication?

Yes, an attacker can exploit CVE-2020-6210 without authentication if they manipulate the vulnerable parameter.