CVE-2020-6200

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

5.4MEDIUM

EPSS

0.4%

top 39.20%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

SAP SE SAP Commerce Cloud (smartedit Extension)SAP Commerce Cloud

Timeline

PublishedMar 10

Latest updateJul 25

Description

The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that exploits the templating facilities of the angular framework.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5sap_se/sap_commerce_cloud_(smartedit_extension)< 6.6+3

▶NVDsap/commerce_cloud4 versions+3

🔴Vulnerability Details

OSV

imagemagick vulnerabilities↗2024-07-25

▶

GHSA

GHSA-h357-g5mj-qr63: The SAP Commerce (SmartEdit Extension), versions- 6↗2022-05-24

▶

CVEList

CVE-2020-6200: The SAP Commerce (SmartEdit Extension), versions- 6↗2020-03-10

▶