6.1
CVE-2020-6215
- EPSS 0.4%
- Veröffentlicht 14.04.2020 20:15:15
- Zuletzt bearbeitet 21.11.2024 05:35:18
- Quelle cna@sap.com
- Teams Watchlist Login
- Unerledigt Login
SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Netweaver As Abap Business Server Pages Version700
SAP ≫ Netweaver As Abap Business Server Pages Version701
SAP ≫ Netweaver As Abap Business Server Pages Version702
SAP ≫ Netweaver As Abap Business Server Pages Version730
SAP ≫ Netweaver As Abap Business Server Pages Version731
SAP ≫ Netweaver As Abap Business Server Pages Version740
SAP ≫ Netweaver As Abap Business Server Pages Version750
SAP ≫ Netweaver As Abap Business Server Pages Version751
SAP ≫ Netweaver As Abap Business Server Pages Version752
SAP ≫ Netweaver As Abap Business Server Pages Version753
SAP ≫ Netweaver As Abap Business Server Pages Version754
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.4% | 0.599 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 5.8 | 8.6 | 4.9 |
AV:N/AC:M/Au:N/C:P/I:P/A:N
|
| cna@sap.com | 6.1 | 2.8 | 2.7 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.