Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2020-6272

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious scr

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP SE SAP Commerce Cloud

  • < 1808affected
  • < 1811affected
  • < 1905affected
  • < 2005affected

References