CVE-2020-6367

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-20 · updated 2026-06-17
Weakness: CWE-79

Description

There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.

Affected products

SAP SE SAP NetWeaver Composite Application Framework: 7.20, 7.30, 7.31, 7.40, 7.50

References

https://launchpad.support.sap.com/#/notes/2972661
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196
https://launchpad.support.sap.com/#/notes/2972661
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196

Get alerted when CVE-2020-6367 or the next vulnerability affects your stack