CVE-2020-6215

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-14 · updated 2026-06-17
Weakness: CWE-601

Description

SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability.

Affected products

SAP NetWeaver AS ABAP (Business Server Pages application): 700, 701, 702, 730, 731, 740 (+5)

References

http://packetstormsecurity.com/files/174985/SAP-Application-Server-ABAP-Open-Redirection.html
http://seclists.org/fulldisclosure/2023/Oct/13
https://launchpad.support.sap.com/#/notes/2872782
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202
http://packetstormsecurity.com/files/174985/SAP-Application-Server-ABAP-Open-Redirection.html
http://seclists.org/fulldisclosure/2023/Oct/13
https://launchpad.support.sap.com/#/notes/2872782
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

Get alerted when CVE-2020-6215 or the next vulnerability affects your stack