CVE-2020-6210: XSS
First published: Tue Mar 10 2020(Updated: )
SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, leading to reflected Cross-Site Scripting (XSS) vulnerability.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Fiori Launchpad | =753 | |
| SAP Fiori Launchpad | =754 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-6210?
CVE-2020-6210 is classified as a medium severity vulnerability due to its potential to lead to reflected Cross-Site Scripting (XSS).
How do I fix CVE-2020-6210?
To fix CVE-2020-6210, ensure that your SAP Fiori Launchpad is updated to a version that properly encodes user-controlled inputs.
What versions of SAP Fiori Launchpad are affected by CVE-2020-6210?
CVE-2020-6210 affects SAP Fiori Launchpad versions 753 and 754.
What type of vulnerability is CVE-2020-6210?
CVE-2020-6210 is a reflected Cross-Site Scripting (XSS) vulnerability that can be exploited through user-controlled input.
Can an attacker exploit CVE-2020-6210 without authentication?
Yes, an attacker can exploit CVE-2020-6210 without authentication if they manipulate the vulnerable parameter.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- vendor/sap
- canonical/sap fiori launchpad
- version/sap fiori launchpad/753
- version/sap fiori launchpad/754