CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 0CVE-2020-6363
https://notcve.org/view.php?id=CVE-2020-6363
SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate active sessions that the user may have with SAP Commerce Cloud web applications, which gives an attacker the opportunity to reuse old session credentials, resulting in Insufficient Session Expiration. SAP Commerce Cloud, versiones - 1808, 1811, 1905, 2005, expone varias aplicaciones web que mantienen sesiones con un usuario. Estas sesiones son establecidas después de que el usuario se haya autenticado con credenciales de nombre de usuario y frase de contraseña. • https://launchpad.support.sap.com/#/notes/2965287 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2020-6272
https://notcve.org/view.php?id=CVE-2020-6272
SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited, resulting in Cross-Site Scripting (XSS) vulnerability. SAP Commerce Cloud versiones - 1808, 1811, 1905, 2005, no codifican suficientemente las entradas del usuario, lo que permite a un administrador de contenido autenticado y autorizado inyectar un script malicioso en varios componentes del CMS web. Estos puede ser guardado y activado posteriormente, si se visita una página web afectada, resultando en una vulnerabilidad de tipo Cross-Site Scripting (XSS) • https://launchpad.support.sap.com/#/notes/2917381 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6238
https://notcve.org/view.php?id=CVE-2020-6238
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce. SAP Commerce, versiones 6.6, 6.7, 1808, 1811, 1905, no procesa una entrada XML de forma segura en la API Rest del Servlet xyformsweb, conllevando a una Falta de Comprobación XML. Esto afecta la confidencialidad y la disponibilidad (parcialmente) de SAP Commerce. • https://launchpad.support.sap.com/#/notes/2904480 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6232
https://notcve.org/view.php?id=CVE-2020-6232
SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check. This affects confidentiality of secure media. SAP Commerce, versiones 1811, 1905, no lleva a cabo las comprobaciones de autorización necesarias para un usuario anónimo, debido a la Falta de Comprobación de Autorización. Esto afecta la confidencialidad de medios seguros. • https://launchpad.support.sap.com/#/notes/2888556 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2020-6201
https://notcve.org/view.php?id=CVE-2020-6201
The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting. SAP Commerce (Testweb Extension), versiones 6.6, 6.7, 1808, 1811, 1905, no codifica suficientemente las entradas controladas por el usuario, debido a que determinados parámetros GET URL son reflejados en las respuestas HTTP sin escape y saneamiento, conllevando a un ataque de tipo Cross Site Scripting Reflejado. • https://launchpad.support.sap.com/#/notes/2876813 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •