CVE-2020-6368

published 2020-10-15

CVE-2020-6368: SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify…

Priority P4 25 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users, leading to Cross Site Scripting.

Affected

18 ranges

Vendor	Product	Version range	Fixed in
sap	business_planning_and_consolidation	—	—
sap	business_planning_and_consolidation	—	—
sap	business_planning_and_consolidation	—	—
sap	business_planning_and_consolidation	—	—
sap	business_planning_and_consolidation	—	—
sap	business_planning_and_consolidation	—	—
sap	business_planning_and_consolidation	—	—
sap	business_planning_and_consolidation	—	—
sap	business_planning_and_consolidation	—	—
sap_se	sap_business_planning_and_consolidation	< 750	750
sap_se	sap_business_planning_and_consolidation	< 751	751
sap_se	sap_business_planning_and_consolidation	< 752	752
sap_se	sap_business_planning_and_consolidation	< 753	753
sap_se	sap_business_planning_and_consolidation	< 754	754
sap_se	sap_business_planning_and_consolidation	< 755	755
sap_se	sap_business_planning_and_consolidation	< 810	810
sap_se	sap_business_planning_and_consolidation	< 100	100
sap_se	sap_business_planning_and_consolidation	< 200	200

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v3.0 5.4 MEDIUM CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79