Cross-site scripting in SAP NetWeaver Application Server ABAP - SAP_BASIS
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content and/or steal authentication information of the user and/or impersonate the user and access all information with the same rights as the target user, leading to Reflected Cross Site Scripting Vulnerability.
Why it matters now
EPSS 0.00768 55th percentileScored 2026-11-07
Fix Fixed SAP NetWeaver Application Server ABAP (Smart Forms) - SAP_BASIS (SAP SE): 7.00, 7.01, 7.02 +10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP NetWeaver Application Server ABAP (Smart Forms) - SAP_BASIS | before 7.00; before 7.01; before 7.02; before 7.10; before 7.11; before 7.30; before 7.31; before 7.40; before 7.50; before 7.51; before 7.52; before 7.53; before 7.54 | 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54 | Patch available | CNA |
- SAP NetWeaver Application Server ABAP (Smart Forms) - SAP_BASIS VendorSAP Affected before 7.00; before 7.01; before 7.02; before 7.10; before 7.11; before 7.30; before 7.31; before 7.40; before 7.50; before 7.51; before 7.52; before 7.53; before 7.54 Fixed in 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54 Patch available CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.00:*:*:*:*:*:*:* | 7.00 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.01:*:*:*:*:*:*:* | 7.01 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.02:*:*:*:*:*:*:* | 7.02 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.10:*:*:*:*:*:*:* | 7.10 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.11:*:*:*:*:*:*:* | 7.11 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.30:*:*:*:*:*:*:* | 7.30 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.31:*:*:*:*:*:*:* | 7.31 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.40:*:*:*:*:*:*:* | 7.40 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.50:*:*:*:*:*:*:* | 7.50 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.51:*:*:*:*:*:*:* | 7.51 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.00:*:*:*:*:*:*:* Versions 7.00 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.01:*:*:*:*:*:*:* Versions 7.01 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.02:*:*:*:*:*:*:* Versions 7.02 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.10:*:*:*:*:*:*:* Versions 7.10 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.11:*:*:*:*:*:*:* Versions 7.11 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.30:*:*:*:*:*:*:* Versions 7.30 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.31:*:*:*:*:*:*:* Versions 7.31 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.40:*:*:*:*:*:*:* Versions 7.40 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.50:*:*:*:*:*:*:* Versions 7.50 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.51:*:*:*:*:*:*:* Versions 7.51 Vulnerable ·SAP
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.52:*:*:*:*:*:*:* | 7.52 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.53:*:*:*:*:*:*:* | 7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.54:*:*:*:*:*:*:* | 7.54 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.52:*:*:*:*:*:*:* Versions 7.52 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:7.54:*:*:*:*:*:*:* Versions 7.54 Vulnerable ·SAP
Remediation
- Fix · CNA SAP NetWeaver Application Server ABAP (Smart Forms) - SAP_BASIS (SAP SE) Fixed in 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6205
- 2026-10-03 Alias added: GHSA-xj38-pj67-738p
References
More SAP Netweaver As Abap Business Server Pages vulnerabilities
- TI-2023-13615 Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) CVSS 3.1MEDIUM 6.5
- TI-2020-05071 Open redirect in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
- TI-2020-05176 Cross-site scripting in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
- TI-2020-05069 Cross-site scripting in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
- TI-2020-05102 Cross-site scripting in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
- TI-2020-05085 Cross-site scripting in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-6205 · CVE Program
- CVE-2020-6205 · NVD
- FIRST EPSS
- GHSA-xj38-pj67-738p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences