VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Sep 9, 2020· Updated Jun 17, 2026

CVE-2020-6313

CVE-2020-6313

Description

SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing JavaScript, leading to Stored Cross-Site Scripting.

Affected products

6
  • SAP SE/SAP NetWeaver AS JAVA (XML Forms)v5
    Range: < 7.30
  • SAP/Netweaver Application Server Javallm-fuzzy5 versions
    7.30, 7.31, 7.40, 7.50+ 4 more
    • (no CPE)range: 7.30, 7.31, 7.40, 7.50
    • cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.