by Kastro
Paper/Archive/CVE-2020-6238

CVE-2020-6238

SAP SE SAP Commerce — SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading…

EPSS 1%CVSS 9.3
critical.is priorityof 100
42
CVSS 9.3 (CNA, NVD agree)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 70.7.707 × 2014.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.

Affected

ProductAffectedFixed inSource
SAP Commerce< 6.6–CNA
SAP Commerce< 6.7–CNA
SAP Commerce< 1808–CNA
SAP Commerce< 1811–CNA
SAP Commerce< 1905–CNA

Scores by source

NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
sap (CNA)9.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202reflaunchpad.support.sap.com/#/notes/2904480