CVE-2020-6283: XSS
SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, the attacker can steal authentication information of the user, such as data relating to his or her current session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-6283?
CVE-2020-6283 is rated as a medium severity vulnerability due to the potential for reflected Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2020-6283?
To remediate CVE-2020-6283, ensure that user-controlled inputs are properly encoded and updated to the latest version of SAP Fiori Launchpad.
What versions of SAP Fiori Launchpad are affected by CVE-2020-6283?
CVE-2020-6283 affects versions 750, 752, 753, 754, and 755 of SAP Fiori Launchpad.
What is the impact of CVE-2020-6283?
The impact of CVE-2020-6283 could allow an attacker to perform XSS attacks, potentially leading to the theft of sensitive user information.
Is CVE-2020-6283 related to injection attacks?
Yes, CVE-2020-6283 involves an injection vulnerability allowing attackers to inject malicious meta tags into the HTML of the SAP Fiori Launchpad.