CVE-2020-6238

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-14 · updated 2026-06-17
Weakness: CWE-611

Description

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.

Affected products

SAP_SE SAP Commerce Cloud: 6.6, 6.7, 1808, 1811, 1905

References

https://launchpad.support.sap.com/#/notes/2904480
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202
https://launchpad.support.sap.com/#/notes/2904480
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

Get alerted when CVE-2020-6238 or the next vulnerability affects your stack