{"id":"CVE-2020-6302","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-6302","generatedAt":"2026-10-27T23:29:50.410Z","title":"An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the…","description":"SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the application.","published":"2020-09-09T13:15:12.000Z","lastModified":"2026-06-17T03:23:02.000Z","status":"Modified","sourceIdentifier":"cna@sap.com","cvss":{"version":"3.1","score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-384"],"affected":["sap/commerce"],"epss":{"score":0.00805,"percentile":0.56485,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.80%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2934451","tags":["Permissions Required"],"source":"cna@sap.com"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700","tags":["Vendor Advisory"],"source":"cna@sap.com"},{"url":"https://launchpad.support.sap.com/#/notes/2934451","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-6302","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}