Skip links

CVE-2020-6368 Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation, SAP security note 2960825

Description

SAP Business Planning and Consolidation can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Available fix and Supported packages

  • BPC4HANA | 100 | 100
  • BPC4HANA | 200 | 200
  • SAP_BW | 750 | 755
  • CPMBPC | 810 | 810
  • BPC4HANA 100 | SAPK-10014INBPC4HANA |
  • BPC4HANA 200 | SAPK-20006INBPC4HANA |
  • SAP_BW 755 | SAPK-75501INSAPBW |
  • SAP_BW 750 | SAPK-75020INSAPBW |
  • SAP_BW 751 | SAPK-75112INSAPBW |
  • | SAPK-783BHINSAPBW |
  • SAP_BW 752 | SAPK-75208INSAPBW |
  • SAP_BW 753 | SAPK-75306INSAPBW |
  • SAP_BW 754 | SAPK-75404INSAPBW |
  • CPMBPC 810 | SAPK-81020INCPMBPC |

Affected component

    EPM-BPC-NW
    NetWeaver Version

CVSS

Score: 5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2960825

TAGS

#&65279-XSS
#Stored-XSS
#&160-CVE-2020-6368