VulnerabilityModified
CVE-2020-6326
SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise…
MEDIUM 5.4EPSS 0.65%
Does this matter?
Lower severity and a low EPSS score (0.65%). Track it; it rarely justifies an emergency change on its own.
Description
SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.65% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- sap/netweaver knowledge management
- Source
- cna@sap.com
References
- https://launchpad.support.sap.com/#/notes/2953112Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2953112Permissions Required
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.