CVE-2020-6272

published 2020-10-15

CVE-2020-6272: SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to…

medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
sap	commerce_cloud	—	—
sap	commerce_cloud	—	—
sap	commerce_cloud	—	—
sap	commerce_cloud	—	—
sap_se	sap_commerce_cloud	< 1808	1808
sap_se	sap_commerce_cloud	< 1811	1811
sap_se	sap_commerce_cloud	< 1905	1905
sap_se	sap_commerce_cloud	< 2005	2005

CWE-79