CVE-2020-6220

published 2022-06-06

CVE-2020-6220: BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting…

medium 4.7 CVSS 3.1

AV N AC H PR N UI R S C C L I L A N

BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Exploit is possible only when the bttoken in victim’s session is active.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
sap	business_objects_business_intelligence_platform	—	—
sap	business_objects_business_intelligence_platform	—	—
sap_se	sap_business_objects_business_intelligence_platform	—	—
sap_se	sap_business_objects_business_intelligence_platform	—	—

CWE-79