SAP security note 2772325, "[CVE-2020-6303] Improper input validation in SAP Disclosure Management". Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Disclosure Management 10.1 does not validate user input properly in specific use cases.
Some well known impacts of improper input validation can be:
- Reflected Cross Site Scripting
- Stored Cross Site Scripting
Solution
You have to manually install SAP Disclosure Management 10.1 Stack 1500 Application Server or later.
The latest downloads are available via SAP ONE Support Launchpad.
Reason and prerequisites
You are using SAP Disclosure Management 10.1 earlier than Stack 1500.
CVSS
Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2772325
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].