CVE-2020-6238

CWE-611 — XML External Entity (XXE)3 documents3 sources
Severity
9.3CRITICAL
EPSS
0.4%
top 38.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP CommerceSAP Commerce Cloud
Timeline
PublishedApr 14
Latest updateMay 24

Description

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:LExploitability: 3.9 | Impact: 4.7

Affected Packages2 packages

▶CVEListV5sap_se/sap_commerce< 6.6+4
▶NVDsap/commerce_cloud5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-66x9-6gmr-h34w: SAP Commerce, versions - 6↗2022-05-24
▶
CVEList
CVE-2020-6238: SAP Commerce, versions - 6↗2020-04-14
▶
CVE-2020-6238 (CRITICAL CVSS 9.3) | SAP Commerce | cvebase.io