CVE-2020-6265

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-09 · updated 2026-06-17
Weakness: CWE-798

Description

SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials.

Affected products

SAP SE SAP Commerce: 6.7, 1808, 1811, 1905
SAP Commerce Data Hub: 6.7, 1808, 1811, 1905

References

https://launchpad.support.sap.com/#/notes/2918924
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775
https://launchpad.support.sap.com/#/notes/2918924
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775

Get alerted when CVE-2020-6265 or the next vulnerability affects your stack