CVE-2020-6302: sap_se sap commerce Session Fixation

Vulnerability summary

CVE-2020-6302 is a high (CVSS 8.1) Session Fixation vulnerability in sap_se sap commerce. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.2% of scored vulnerabilities.

Timeline

1. 09-09-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the application.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.