VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Oct 20, 2020· Updated Jun 17, 2026

CVE-2020-6366

CVE-2020-6366

Description

SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service.

Affected products

7
  • SAP/Netweaver Compare Systems5 versions
    cpe:2.3:a:sap:netweaver_compare_systems:7.20:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:sap:netweaver_compare_systems:7.20:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_compare_systems:7.30:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_compare_systems:7.31:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_compare_systems:7.40:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:netweaver_compare_systems:7.50:*:*:*:*:*:*:*
  • SAP/Netweaverllm-fuzzy
    Range: 7.20, 7.30, 7.40, 7.50
  • SAP SE/SAP NetWeaver (Compare Systems)v5
    Range: < 7.20

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.