CVE-2020-6323

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-15 · updated 2026-06-17
Weakness: CWE-79

Description

SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the system, resulting in Cross Site Scripting.

Affected products

SAP SE SAP NetWeaver Enterprise Portal: 7.31, 7.40, 7.50

References

https://launchpad.support.sap.com/#/notes/2960329
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196
https://launchpad.support.sap.com/#/notes/2960329
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196

Get alerted when CVE-2020-6323 or the next vulnerability affects your stack