VulnerabilityModified
CVE-2020-6260
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation.
MEDIUM 5.3EPSS 0.78%
Does this matter?
Lower severity and a low EPSS score (0.78%). Track it; it rarely justifies an emergency change on its own.
Description
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-91
- Affected
- sap/solution manager
- Source
- cna@sap.com
References
- https://launchpad.support.sap.com/#/notes/2915126Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2915126Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.