by Kastro
Paper/Archive/CVE-2020-6265

CVE-2020-6265

SAP SE SAP Commerce — SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypa…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.7.717 × 2014.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication and/or authorization that has been configured by the system administrator due to the use of Hardcoded Credentials.

Affected

ProductAffectedFixed inSource
SAP Commerce< 6.7–CNA
SAP Commerce< 1808–CNA
SAP Commerce< 1811–CNA
SAP Commerce< 1905–CNA
SAP Commerce (Data Hub)< 6.7–CNA
SAP Commerce (Data Hub)< 1808–CNA
SAP Commerce (Data Hub)< 1811–CNA
SAP Commerce (Data Hub)< 1905–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reflaunchpad.support.sap.com/#/notes/2918924refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775