Medium severity · published Sep 9, 2020
CVE-2020-6283
SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable…
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, the attacker can steal authentication information of the user, such as data relating to his or her current session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Fiori Launchpad · Sap
750; 752; 753; 754; 755 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6283
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6283
Permissions Required
https://launchpad.support.sap.com/#/notes/2865229
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700
More from Fiori Launchpad
6.1
CVE-2022-26101
Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability
6.1
CVE-2020-6210
SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using…
4.3
CVE-2023-49584
Client-Side Desynchronization vulnerability in SAP Fiori Launchpad