« Volver al listado

CVE-2020-6238

Estado: ModificadaCrítica (9.3)—

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Commerce Cloud

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6238",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9.3,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.3,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP SE",
          "product": "SAP Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "< 6.6"
            },
            {
              "status": "affected",
              "version": "< 6.7"
            },
            {
              "status": "affected",
              "version": "< 1808"
            },
            {
              "status": "affected",
              "version": "< 1811"
            },
            {
              "status": "affected",
              "version": "< 1905"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-14T19:15:18.437",
  "references": [
    {
      "url": "https://launchpad.support.sap.com/#/notes/2904480",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2904480",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce."
    },
    {
      "lang": "es",
      "value": "SAP Commerce, versiones 6.6, 6.7, 1808, 1811, 1905, no procesa una entrada XML de forma segura en la API Rest del Servlet xyformsweb, conllevando a una Falta de Comprobación XML. Esto afecta la confidencialidad y la disponibilidad (parcialmente) de SAP Commerce."
    }
  ],
  "lastModified": "2026-06-17T03:22:55.440",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB45CC6E-1837-4B0A-9F78-730161506D6D"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F32D694A-18E7-40E3-8EE0-9A240DED7A34"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5649AB0A-1D84-4716-A178-F196A1DA9C1A"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9DE60D1-95FF-4220-AE63-2C351781FDA1"
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19E11B22-F514-48D6-B78F-8A64CE1BA364"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}