CVE-2020-6368

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-15 · updated 2026-06-17
Weakness: CWE-79

Description

SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users, leading to Cross Site Scripting.

Affected products

SAP Business Planning and Consolidation: 100, 200, 750, 751, 752, 753 (+3)

References

https://launchpad.support.sap.com/#/notes/2960825
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196
https://launchpad.support.sap.com/#/notes/2960825
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196

Get alerted when CVE-2020-6368 or the next vulnerability affects your stack