CVE-2020-6313 Cross-site scripting in SAP NetWeaver AS JAVA (XML Forms)
Authenticated users can inject malicious JavaScript into SAP NetWeaver XML Forms, leading to stored XSS attacks against victims.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-6313?
CVE-2020-6313 is a medium-severity cross-site scripting vulnerability in Sap Netweaver Application Server Java, published on 9 Sep 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing JavaScript, leading to Stored Cross-Site Scripting.
Which versions are affected by CVE-2020-6313?
It affects 1 product.
Products include Sap Netweaver Application Server Java.
How do I fix CVE-2020-6313?
No fix has been published for CVE-2020-6313 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-6313 being exploited?
There is no known exploitation of CVE-2020-6313 in the wild and no public exploit code.
Other vulnerabilities in Sap Netweaver Application Server Java
Sources
Also known as GHSA-4xqv-wh6m-q95v.