CVE-2020-6185 - Vulnerability Details - OpenCVE

Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sap	Netweaver S\/4hana

Configuration 1 [-]

OR	cpe:2.3:a:sap:netweaver:7.40:::::::*
	cpe:2.3:a:sap:s\/4hana:7.50:::::::*
	cpe:2.3:a:sap:s\/4hana:7.51:::::::*
	cpe:2.3:a:sap:s\/4hana:7.52:::::::*
	cpe:2.3:a:sap:s\/4hana:7.53:::::::*
	cpe:2.3:a:sap:s\/4hana:7.54:::::::*

No data.

References

Link	Providers
https://launchpad.support.sap.com/#/notes/2880869
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812

History

No history.

MITRE

Status: PUBLISHED

Assigner: sap

Published: 2020-02-12T19:56:20

Updated: 2024-08-04T08:55:22.130Z

Reserved: 2020-01-08T00:00:00

Link: CVE-2020-6185

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-02-12T20:15:14.120

Modified: 2024-11-21T05:35:15.507

Link: CVE-2020-6185

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "SAP NetWeaver (SAP Basis)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "= 7.40"}]}, {"product": "SAP S/4HANA (SAP Basis)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "= 7.50"}, {"status": "affected", "version": "= 7.51"}, {"status": "affected", "version": "= 7.52"}, {"status": "affected", "version": "= 7.53"}, {"status": "affected", "version": "= 7.54"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Stored Cross Site Scripting", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-12T19:56:20", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}, {"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/2880869"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2020-6185", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP NetWeaver (SAP Basis)", "version": {"version_data": [{"version_name": "=", "version_value": "7.40"}]}}, {"product_name": "SAP S/4HANA (SAP Basis)", "version": {"version_data": [{"version_name": "=", "version_value": "7.50"}, {"version_name": "=", "version_value": "7.51"}, {"version_name": "=", "version_value": "7.52"}, {"version_name": "=", "version_value": "7.53"}, {"version_name": "=", "version_value": "7.54"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability."}]}, "impact": {"cvss": {"baseScore": "5.4", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Stored Cross Site Scripting"}]}]}, "references": {"reference_data": [{"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}, {"name": "https://launchpad.support.sap.com/#/notes/2880869", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/2880869"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T08:55:22.130Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://launchpad.support.sap.com/#/notes/2880869"}]}]}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2020-6185", "datePublished": "2020-02-12T19:56:20", "dateReserved": "2020-01-08T00:00:00", "dateUpdated": "2024-08-04T08:55:22.130Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*", "matchCriteriaId": "F019F7F5-7740-4BD4-850F-D7A1923C6200", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.50:*:*:*:*:*:*:*", "matchCriteriaId": "EEBE3705-6F2A-4FC0-8FB8-B908DDC8A4C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.51:*:*:*:*:*:*:*", "matchCriteriaId": "15229BC5-B8AB-4EA3-91A9-54B080725A00", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.52:*:*:*:*:*:*:*", "matchCriteriaId": "DDAE64AB-5839-4177-B07E-6C24D2F27B39", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.53:*:*:*:*:*:*:*", "matchCriteriaId": "87343FA6-3D2D-4F9A-8999-F3996B8C7325", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.54:*:*:*:*:*:*:*", "matchCriteriaId": "E98D0261-4C52-45E1-BF8F-B2A15CE426EC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability."}, {"lang": "es", "value": "Bajo determinadas condiciones, ABAP Online Community en SAP NetWeaver (SAP_BASIS versi\u00f3n 7.40) y SAP S/4HANA (SAP_BASIS versiones 7.50, 7.51, 7.52, 7.53, 7.54), permite a un atacante autenticado almacenar una carga \u00fatil maliciosa que resulta en una vulnerabilidad de tipo Cross Site Scripting Almacenado."}], "id": "CVE-2020-6185", "lastModified": "2024-11-21T05:35:15.507", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "cna@sap.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-12T20:15:14.120", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2880869"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2880869"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}