Skip links

CVE-2020-6284 Cross-Site Scripting (XSS) in SAP NetWeaver (Knowledge Management), SAP security note 2928635

Description

UPDATE 27th October 2020: This note has been re-released with updated ‘Correction instruction’ information for the release NetWeaver 7.50 SP12.

SAP NetWeaver Knowledge Management (KM) allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user’s privileges. If the accessing user has administrative privileges, then the execution of the script content could result in complete compromise of system confidentiality, integrity and availability.

Available fix and Supported packages

  • KMC-CM | 7.30 | 7.30
  • KMC-CM | 7.31 | 7.31
  • KMC-CM | 7.40 | 7.40
  • KMC-CM | 7.50 | 7.50
  • KMC CONTENT MANAGEMENT 7.30 | SP015 | 000011
  • KMC CONTENT MANAGEMENT 7.30 | SP016 | 000009
  • KMC CONTENT MANAGEMENT 7.30 | SP017 | 000007
  • KMC CONTENT MANAGEMENT 7.30 | SP018 | 000005
  • KMC CONTENT MANAGEMENT 7.30 | SP019 | 000007
  • KMC CONTENT MANAGEMENT 7.30 | SP020 | 000005
  • KMC CONTENT MANAGEMENT 7.30 | SP021 | 000000
  • KMC CONTENT MANAGEMENT 7.31 | SP022 | 000006
  • KMC CONTENT MANAGEMENT 7.31 | SP023 | 000006
  • KMC CONTENT MANAGEMENT 7.31 | SP024 | 000004
  • KMC CONTENT MANAGEMENT 7.31 | SP025 | 000005
  • KMC CONTENT MANAGEMENT 7.31 | SP026 | 000004
  • KMC CONTENT MANAGEMENT 7.31 | SP027 | 000000
  • KMC CONTENT MANAGEMENT 7.31 | SP028 | 000000
  • KMC CONTENT MANAGEMENT 7.40 | SP017 | 000006
  • KMC CONTENT MANAGEMENT 7.40 | SP018 | 000006
  • KMC CONTENT MANAGEMENT 7.40 | SP019 | 000004
  • KMC CONTENT MANAGEMENT 7.40 | SP020 | 000005
  • KMC CONTENT MANAGEMENT 7.40 | SP021 | 000004
  • KMC CONTENT MANAGEMENT 7.40 | SP022 | 000000

Affected component

    EP-KM-CM
    Content Management

CVSS

Score: 9.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2928635

TAGS

#XSS
#stored-XSS
#&160-CVE-2020-6284