CVE-2020-6205

{"id": "CVE-2020-6205", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-03-10T21:15:14.620", "references": [{"url": "https://launchpad.support.sap.com/#/notes/2884910", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content and/or steal authentication information of the user and/or impersonate the user and access all information with the same rights as the target user, leading to Reflected Cross Site Scripting Vulnerability."}, {"lang": "es", "value": "SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), versiones de SAP_BASIS 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; no codifica suficientemente las entradas controladas por el usuario, permitiendo a un atacante no autenticado desfigurar de forma no permanente o modificar el contenido mostrado y/o robar informaci\u00f3n de autenticaci\u00f3n del usuario y/o suplantar al usuario y acceder a toda la informaci\u00f3n con los mismos derechos que el usuario objeto del ataque, conllevando a una Vulnerabilidad de tipo Cross Site Scripting Reflejado."}], "lastModified": "2023-09-26T20:09:05.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E6E948A-59A4-460A-8369-68E9A94CA4EC"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B2AC049-E6B5-4954-875A-7E66F2CEFEDF"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1097BE81-D7C7-4288-82A8-F5FA0EB492E3"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A14A2CCD-4E29-42BF-94E8-6FBCF7265132"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC7F939D-7BC7-48DF-BBC7-867341F841CC"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66D0CBF3-A0C0-4125-87D2-15DC05990986"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4AA4EAF-ED70-4FEC-85B5-C8229EB5F600"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F822C6B-3047-4EB1-9A85-EE10EA592DE4"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.50:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "689471D5-2189-48AF-ACE9-41DA4B642B1E"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.51:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD618C71-34FF-414C-86DC-C43C5EEF5D20"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.52:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E4BD107-F102-4859-9439-955F4DACE96F"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.53:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AC0B6B2-BE6F-4745-ACE4-245B0685734F"}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.54:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07A358CC-0FE7-4665-B595-169F784A5AC1"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}