CVE-2020-26825

published 2020-11-13

CVE-2020-26825: SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile…

Priority P4 25 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim's web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim's browser and the victim can easily close the browser tab to terminate it.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
sap	fiori_launchpad	—	—
sap	fiori_launchpad	—	—
sap	fiori_launchpad	—	—
sap	fiori_launchpad	—	—
sap	fiori_launchpad	—	—
sap	fiori_launchpad	—	—
sap_se	sap_fiori_launchpad	< 750	750
sap_se	sap_fiori_launchpad	< 751	751
sap_se	sap_fiori_launchpad	< 752	752
sap_se	sap_fiori_launchpad	< 753	753
sap_se	sap_fiori_launchpad	< 754	754
sap_se	sap_fiori_launchpad	< 755	755

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79