VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Oct 15, 2020· Updated Jun 17, 2026

CVE-2020-6323

CVE-2020-6323

Description

SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the system, resulting in Cross Site Scripting.

Affected products

5
  • SAP SE/SAP NetWeaver Enterprise Portal (Fiori Framework Page)v5
    Range: < 7.50
  • SAP/NetWeaver Enterprise Portalllm-fuzzy
    Range: 7.50, 7.31, 7.40
  • SAP/NetWeaver Enterprise Portal Federated Portal Network3 versions
    cpe:2.3:a:sap:netweaver_enterprise_portal:7.31:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:sap:netweaver_enterprise_portal:7.31:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_enterprise_portal:7.40:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_enterprise_portal:7.50:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.