CVE-2020-6319

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-15 · updated 2026-06-17
Weakness: CWE-79

Description

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal authentication information of the user, such as data relating to his or her current session and limitedly impact confidentiality and integrity of the application, leading to Reflected Cross Site Scripting.

Affected products

SAP NetWeaver AS Java: 7.10, 7.11, 7.20, 7.30, 7.31, 7.40 (+1)

References

https://launchpad.support.sap.com/#/notes/2956398
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196
https://launchpad.support.sap.com/#/notes/2956398
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196

Get alerted when CVE-2020-6319 or the next vulnerability affects your stack