« Volver al listado

CVE-2020-6217

Estado: ModificadaMedia (6.1)—

SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver AS Abap Business Server Pages

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6217",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP NetWeaver AS ABAP (Business Server Pages Test Application IT05)",
          "versions": [
            {
              "status": "affected",
              "version": "< 700"
            },
            {
              "status": "affected",
              "version": "< 701"
            },
            {
              "status": "affected",
              "version": "< 702"
            },
            {
              "status": "affected",
              "version": "< 730"
            },
            {
              "status": "affected",
              "version": "< 731"
            },
            {
              "status": "affected",
              "version": "< 740"
            },
            {
              "status": "affected",
              "version": "< 750"
            },
            {
              "status": "affected",
              "version": "< 751"
            },
            {
              "status": "affected",
              "version": "< 752"
            },
            {
              "status": "affected",
              "version": "< 753"
            },
            {
              "status": "affected",
              "version": "< 754"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-14T20:15:15.340",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2872545",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2872545",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability."
    },
    {
      "lang": "es",
      "value": "SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versiones 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, no codifica suficientemente las entradas controladas por el usuario, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS) reflejada."
    }
  ],
  "lastModified": "2026-06-17T03:22:53.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:700:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C730F7F7-B228-4D3E-BC02-33EE5D695D69"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:701:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE253C97-C802-476B-81FB-BA4FC15B433C"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:702:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DCD414F-0C97-4657-BF48-11DA3A83850E"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:730:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB7A2294-4A88-436E-A847-1D88DBB1877E"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:731:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C167C76A-0F85-47F3-A90E-8DA4EA8C3B74"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:740:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF90E047-B917-4C52-8A5B-99BFA094E90D"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:750:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAE99B15-44F0-47A1-AD2F-D92BCCA940F8"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:751:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C00F292E-E761-47AA-A82D-456CBA829BDD"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:752:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4662F413-B285-4310-AA7C-D8AD60E024DE"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:753:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76D5B33D-9FFE-4492-8879-5738CD963D09"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:754:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2C50935-7C21-4248-A707-60E08FA860DC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}