CVE-2020-6184 - Vulnerability Details

Vendors	Products
Sap	Netweaver S\/4hana

Link	Providers
https://launchpad.support.sap.com/#/notes/2863397
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Automated Note Search Tool (SAP Basis)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< 7.0"}, {"status": "affected", "version": "< 7.01"}, {"status": "affected", "version": "< 7.02"}, {"status": "affected", "version": "< 7.31"}, {"status": "affected", "version": "< 7.4"}, {"status": "affected", "version": "< 7.5"}, {"status": "affected", "version": "< 7.51"}, {"status": "affected", "version": "< 7.52"}, {"status": "affected", "version": "< 7.53"}, {"status": "affected", "version": "< 7.54"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Missing Authorization Check", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-12T19:46:26", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/2863397"}, {"tags": ["x_refsource_MISC"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2020-6184", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Automated Note Search Tool (SAP Basis)", "version": {"version_data": [{"version_name": "<", "version_value": "7.0"}, {"version_name": "<", "version_value": "7.01"}, {"version_name": "<", "version_value": "7.02"}, {"version_name": "<", "version_value": "7.31"}, {"version_name": "<", "version_value": "7.4"}, {"version_name": "<", "version_value": "7.5"}, {"version_name": "<", "version_value": "7.51"}, {"version_name": "<", "version_value": "7.52"}, {"version_name": "<", "version_value": "7.53"}, {"version_name": "<", "version_value": "7.54"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability."}]}, "impact": {"cvss": {"baseScore": "6.1", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Missing Authorization Check"}]}]}, "references": {"reference_data": [{"name": "https://launchpad.support.sap.com/#/notes/2863397", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/2863397"}, {"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812", "refsource": "MISC", "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T08:55:22.128Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://launchpad.support.sap.com/#/notes/2863397"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}]}]}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2020-6184", "datePublished": "2020-02-12T19:46:26", "dateReserved": "2020-01-08T00:00:00", "dateUpdated": "2024-08-04T08:55:22.128Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Automated Note Search Tool (SAP Basis) (string)

vendor : SAP SE (string)

versions : [ »

0 : { »

status : affected (string)

version : < 7.0 (string)

}

1 : { »

status : affected (string)

version : < 7.01 (string)

}

2 : { »

status : affected (string)

version : < 7.02 (string)

}

3 : { »

status : affected (string)

version : < 7.31 (string)

}

4 : { »

status : affected (string)

version : < 7.4 (string)

}

5 : { »

status : affected (string)

version : < 7.5 (string)

}

6 : { »

status : affected (string)

version : < 7.51 (string)

}

7 : { »

status : affected (string)

version : < 7.52 (string)

}

8 : { »

status : affected (string)

version : < 7.53 (string)

}

9 : { »

status : affected (string)

version : < 7.54 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. (string)

}

]

metrics : [ »

0 : { »

cvssV3_0 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.0 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Missing Authorization Check (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2020-02-12T19:46:26 (string)

orgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

shortName : sap (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://launchpad.support.sap.com/#/notes/2863397 (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cna@sap.com (string)

ID : CVE-2020-6184 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Automated Note Search Tool (SAP Basis) (string)

version : { »

version_data : [ »

0 : { »

version_name : < (string)

version_value : 7.0 (string)

}

1 : { »

version_name : < (string)

version_value : 7.01 (string)

}

2 : { »

version_name : < (string)

version_value : 7.02 (string)

}

3 : { »

version_name : < (string)

version_value : 7.31 (string)

}

4 : { »

version_name : < (string)

version_value : 7.4 (string)

}

5 : { »

version_name : < (string)

version_value : 7.5 (string)

}

6 : { »

version_name : < (string)

version_value : 7.51 (string)

}

7 : { »

version_name : < (string)

version_value : 7.52 (string)

}

8 : { »

version_name : < (string)

version_value : 7.53 (string)

}

9 : { »

version_name : < (string)

version_value : 7.54 (string)

}

]

}

]

}

vendor_name : SAP SE (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. (string)

}

]

}

impact : { »

cvss : { »

baseScore : 6.1 (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.0 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Missing Authorization Check (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://launchpad.support.sap.com/#/notes/2863397 (string)

refsource : MISC (string)

url : https://launchpad.support.sap.com/#/notes/2863397 (string)

}

1 : { »

name : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 (string)

refsource : MISC (string)

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T08:55:22.128Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://launchpad.support.sap.com/#/notes/2863397 (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : e4686d1a-f260-4930-ac4c-2f5c992778dd (string)

assignerShortName : sap (string)

cveId : CVE-2020-6184 (string)

datePublished : 2020-02-12T19:46:26 (string)

dateReserved : 2020-01-08T00:00:00 (string)

dateUpdated : 2024-08-04T08:55:22.128Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:*", "matchCriteriaId": "F019F7F5-7740-4BD4-850F-D7A1923C6200", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.50:*:*:*:*:*:*:*", "matchCriteriaId": "EEBE3705-6F2A-4FC0-8FB8-B908DDC8A4C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.51:*:*:*:*:*:*:*", "matchCriteriaId": "15229BC5-B8AB-4EA3-91A9-54B080725A00", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.52:*:*:*:*:*:*:*", "matchCriteriaId": "DDAE64AB-5839-4177-B07E-6C24D2F27B39", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.53:*:*:*:*:*:*:*", "matchCriteriaId": "87343FA6-3D2D-4F9A-8999-F3996B8C7325", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana:7.54:*:*:*:*:*:*:*", "matchCriteriaId": "E98D0261-4C52-45E1-BF8F-B2A15CE426EC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability."}, {"lang": "es", "value": "Bajo determinadas condiciones, ABAP Online Community en SAP NetWeaver (SAP_BASIS versi\u00f3n 7.40) y SAP S/4HANA (SAP_BASIS versiones 7.50, 7.51, 7.52, 7.53, 7.54), no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS) Reflejado."}], "id": "CVE-2020-6184", "lastModified": "2024-11-21T05:35:15.393", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "cna@sap.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-12T20:15:13.997", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2863397"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/2863397"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:* (string)

matchCriteriaId : F019F7F5-7740-4BD4-850F-D7A1923C6200 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:sap:s\/4hana:7.50:*:*:*:*:*:*:* (string)

matchCriteriaId : EEBE3705-6F2A-4FC0-8FB8-B908DDC8A4C8 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:sap:s\/4hana:7.51:*:*:*:*:*:*:* (string)

matchCriteriaId : 15229BC5-B8AB-4EA3-91A9-54B080725A00 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:sap:s\/4hana:7.52:*:*:*:*:*:*:* (string)

matchCriteriaId : DDAE64AB-5839-4177-B07E-6C24D2F27B39 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:sap:s\/4hana:7.53:*:*:*:*:*:*:* (string)

matchCriteriaId : 87343FA6-3D2D-4F9A-8999-F3996B8C7325 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:sap:s\/4hana:7.54:*:*:*:*:*:*:* (string)

matchCriteriaId : E98D0261-4C52-45E1-BF8F-B2A15CE426EC (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. (string)

}

1 : { »

lang : es (string)

value : Bajo determinadas condiciones, ABAP Online Community en SAP NetWeaver (SAP_BASIS versión 7.40) y SAP S/4HANA (SAP_BASIS versiones 7.50, 7.51, 7.52, 7.53, 7.54), no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS) Reflejado. (string)

}

]

id : CVE-2020-6184 (string)

lastModified : 2024-11-21T05:35:15.393 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : cna@sap.com (string)

type : Secondary (string)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2020-02-12T20:15:13.997 (string)

references : [ »

0 : { »

source : cna@sap.com (string)

tags : [ »

0 : Permissions Required (string)

1 : Vendor Advisory (string)

]

url : https://launchpad.support.sap.com/#/notes/2863397 (string)

}

1 : { »

source : cna@sap.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Permissions Required (string)

1 : Vendor Advisory (string)

]

url : https://launchpad.support.sap.com/#/notes/2863397 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 (string)

}

]

sourceIdentifier : cna@sap.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object