CVE-2020-6323: XSS

Published Oct 15, 2020

Updated

SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the system, resulting in Cross Site Scripting.

Affected Software

3 affected components

SAP NetWeaver Enterprise Portal=7.31

SAP NetWeaver Enterprise Portal=7.40

SAP NetWeaver Enterprise Portal=7.50

Event History

Oct 15, 2020

CVE Published

via MITRE·01:45 AM

Data Sourced

via MITRE·01:45 AM

DescriptionWeakness

Frequently Asked Questions

What is the CVE ID for this vulnerability?

The CVE ID for this vulnerability is CVE-2020-6323.

What is the severity of CVE-2020-6323?

The severity of CVE-2020-6323 is medium (6.1).

Which versions of SAP NetWeaver Enterprise Portal are affected?

SAP NetWeaver Enterprise Portal versions 7.31, 7.40, and 7.50 are affected.

How does this vulnerability affect SAP NetWeaver Enterprise Portal?

This vulnerability allows an attacker with a valid session to create a reflected and persisted XSS attack.

How can I fix CVE-2020-6323?

To fix CVE-2020-6323, apply the recommended patches provided by SAP and follow the guidelines mentioned in the SAP notes referenced in the vulnerability details.