CVE-2020-6313: sap se sap netweaver as java (xml forms) Cross-site Scripting
Vulnerability summary
CVE-2020-6313 is a medium (CVSS 6.5) Cross-site Scripting vulnerability in sap se sap netweaver as java (xml forms). EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.3% of scored vulnerabilities.
Timeline
- 09-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing JavaScript, leading to Stored Cross-Site Scripting.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
0.00 pp
From 0.72% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Sap1 product
- netweaver_application_server_java7.30 | 7.31 | 7.40 | 7.50
Sap se1 product
- sap netweaver as java (xml forms)< 7.30 | < 7.31 | < 7.40 | < 7.50
2 vendors · 2 products