{"id":"CVE-2020-6254","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-6254","generatedAt":"2026-10-27T22:33:32.721Z","title":"SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.","description":"SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.","published":"2020-05-12T18:15:15.000Z","lastModified":"2026-06-17T03:22:57.000Z","status":"Modified","sourceIdentifier":"cna@sap.com","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["sap/enterprise threat detection"],"epss":{"score":0.00654,"percentile":0.5103,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.65%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2913293","tags":["Permissions Required"],"source":"cna@sap.com"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","tags":["Vendor Advisory"],"source":"cna@sap.com"},{"url":"https://launchpad.support.sap.com/#/notes/2913293","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-6254","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}