CVE-2020-6363: SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established…

PriorityP423medium4.6CVSS 3.1

AVNACLPRLUIRSUCLILAN

EPSS

0.53%

41.2th percentile

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate active sessions that the user may have with SAP Commerce Cloud web applications, which gives an attacker the opportunity to reuse old session credentials, resulting in Insufficient Session Expiration.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
sap	commerce_cloud	—	—
sap	commerce_cloud	—	—
sap	commerce_cloud	—	—
sap	commerce_cloud	—	—
sap_se	sap_commerce_cloud	< 1808	1808
sap_se	sap_commerce_cloud	< 1811	1811
sap_se	sap_commerce_cloud	< 1905	1905
sap_se	sap_commerce_cloud	< 2005	2005

CVSS provenance

nvdv3.14.6MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.