What’s Vulnerable › Vulnerabilities

CVE-2020-6313

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-09-09 · updated 2026-06-17
• Weakness: CWE-79

Description

SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing JavaScript, leading to Stored Cross-Site Scripting.

Affected products

• SAP NetWeaver AS Java: 7.30, 7.31, 7.40, 7.50

References

• https://launchpad.support.sap.com/#/notes/2953112
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700
• https://launchpad.support.sap.com/#/notes/2953112
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700

Get alerted when CVE-2020-6313 or the next vulnerability affects your stack