CVE-2020-6254

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-12 · updated 2026-06-17
Weakness: CWE-79

Description

SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.

Affected products

SAP SE SAP Enterprise Threat Detection: 1.0, 2.0

References

https://launchpad.support.sap.com/#/notes/2913293
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222
https://launchpad.support.sap.com/#/notes/2913293
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222

Get alerted when CVE-2020-6254 or the next vulnerability affects your stack