Medium severity · published Apr 14, 2020
CVE-2020-6215
SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redirect users to a…
6.1
CVSS
1.5%
EPSS
No
On KEV
Description
SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Netweaver AS Abap Business Server Pages · Sap
700; 701; 702; 730; 731; 740; +5 more · source: NVD
Affected product
NA
Netweaver AS Abap Business Server Pages
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6215
packetstormsecurity.com
http://packetstormsecurity.com/files/174985/SAP-Application-Server-ABAP-Open-Redirection.html
seclists.org
http://seclists.org/fulldisclosure/2023/Oct/13
Permissions Required
https://launchpad.support.sap.com/#/notes/2872782
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202
More from Netweaver AS Abap Business Server Pages
6.5
CVE-2023-29185
SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a…
6.1
CVE-2023-24529
Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs…
6.1
CVE-2023-24521
Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated…
6.1
CVE-2020-6324
SAP Netweaver AS ABAP(BSP Test Application sbspext_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send polluted URL to the…
6.1
CVE-2020-6246
SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode…