by Kastro
Paper/Archive/CVE-2020-6320

CVE-2020-6320

SAP SE SAP Marketing (Mobile Channel Servlet) — SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted.

EPSS 1.0%CVSS 9.6
critical.is priorityof 100
41
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 61.3.613 × 2012.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. Limited knowledge of payload is required for an attacker to exploit the vulnerability and perform tasks related to contact and interaction data which impacts Confidentiality and Integrity of data in the application.

Affected

ProductAffectedFixed inSource
SAP Marketing (Mobile Channel Servlet)< 130–CNA
SAP Marketing (Mobile Channel Servlet)< 140–CNA
SAP Marketing (Mobile Channel Servlet)< 150–CNA

Scores by source

sap (CNA)9.6CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700reflaunchpad.support.sap.com/#/notes/2961991