CVE-2020-6272

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-15 · updated 2026-06-17
Weakness: CWE-79

Description

SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized content manager to inject malicious script into several web CMS components. These can be saved and later triggered, if an affected web page is visited, resulting in Cross-Site Scripting (XSS) vulnerability.

Affected products

SAP_SE SAP Commerce Cloud: 1808, 1811, 1905, 2005

References

https://launchpad.support.sap.com/#/notes/2917381
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196
https://launchpad.support.sap.com/#/notes/2917381
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196

Get alerted when CVE-2020-6272 or the next vulnerability affects your stack