CVE-2020-6319: XSS
First published: Thu Oct 15 2020(Updated: )
SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal authentication information of the user, such as data relating to his or her current session and limitedly impact confidentiality and integrity of the application, leading to Reflected Cross Site Scripting.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP NetWeaver AS for Java | =7.10 | |
| SAP NetWeaver AS for Java | =7.11 | |
| SAP NetWeaver AS for Java | =7.20 | |
| SAP NetWeaver AS for Java | =7.30 | |
| SAP NetWeaver AS for Java | =7.31 | |
| SAP NetWeaver AS for Java | =7.40 | |
| SAP NetWeaver AS for Java | =7.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-6319?
CVE-2020-6319 has been rated as having high severity due to the risk of unauthorized access to sensitive information.
How do I fix CVE-2020-6319?
To fix CVE-2020-6319, upgrade your SAP NetWeaver Application Server Java to a patched version as recommended by SAP.
What versions of SAP NetWeaver are affected by CVE-2020-6319?
CVE-2020-6319 affects SAP NetWeaver Application Server Java versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50.
Can CVE-2020-6319 be exploited remotely?
Yes, CVE-2020-6319 can be exploited remotely by an unauthenticated attacker.
What type of vulnerability is CVE-2020-6319?
CVE-2020-6319 is a cross-site scripting (XSS) vulnerability that allows script injection into web pages.
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sap
- canonical/sap netweaver as for java
- version/sap netweaver as for java/7.10
- version/sap netweaver as for java/7.11
- version/sap netweaver as for java/7.20
- version/sap netweaver as for java/7.30
- version/sap netweaver as for java/7.31
- version/sap netweaver as for java/7.40
- version/sap netweaver as for java/7.50