CVE-2020-6283

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-09 · updated 2026-06-17
Weakness: CWE-79

Description

SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, the attacker can steal authentication information of the user, such as data relating to his or her current session.

Affected products

SAP_SE SAP Fiori Launchpad: 750, 752, 753, 754, 755

References

https://launchpad.support.sap.com/#/notes/2865229
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700
https://launchpad.support.sap.com/#/notes/2865229
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700

Get alerted when CVE-2020-6283 or the next vulnerability affects your stack