CVE-2020-6366 XML external entity in SAP NetWeaver (Compare Systems)
An attacker with administrative privileges can exploit insufficient XML validation to retrieve arbitrary OS files or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6366?
CVE-2020-6366 is a high-severity vulnerability in SAP NetWeaver (Compare Systems), published on 20 Oct 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service.
Weakness: CWE-20
Which versions are affected by CVE-2020-6366?
It affects 1 product.
Products include Sap Netweaver Compare Systems.
How do I fix CVE-2020-6366?
No fix has been published for CVE-2020-6366 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6366 being exploited?
There is no known exploitation of CVE-2020-6366 in the wild and no public exploit code.
Sources
Also known as GHSA-fh47-4vp6-4g46.