XML external entity injection in SAP Commerce
Priority MEDIUM 43CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.
Why it matters now
EPSS 0.0131 70th percentileScored 2026-11-07
Fix Fixed SAP Commerce (SAP SE): 6.6, 6.7, 1808 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Commerce | before 6.6; before 6.7; before 1808; before 1811; before 1905 | 6.6, 6.7, 1808, 1811, 1905 | Patch available | CNA |
- SAP Commerce VendorSAP Affected before 6.6; before 6.7; before 1808; before 1811; before 1905 Fixed in 6.6, 6.7, 1808, 1811, 1905 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:* | 6.6 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:* | 6.7 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:* | 1808 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:* | 1811 | Vulnerable | SAP |
| cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:* | 1905 | Vulnerable | SAP |
- cpe:2.3:a:sap:commerce_cloud:6.6:*:*:*:*:*:*:* Versions 6.6 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:1808:*:*:*:*:*:*:* Versions 1808 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:1811:*:*:*:*:*:*:* Versions 1811 Vulnerable ·SAP
- cpe:2.3:a:sap:commerce_cloud:1905:*:*:*:*:*:*:* Versions 1905 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Commerce (SAP SE) Fixed in 6.6, 6.7, 1808, 1811, 1905
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6238
- 2026-10-03 Alias added: GHSA-66x9-6gmr-h34w
References
More SAP Commerce Cloud vulnerabilities
- TI-2019-00284 Deserialization of untrusted data in SAP Commerce Cloud KEVCVSS 3.1CRITICAL 9.8
- TI-2023-20575 SAP Commerce accepts empty passphrases. CVSS 3.1CRITICAL 9.8
- TI-2024-21868 Information Disclosure Vulnerability in SAP Commerce Cloud CVSS 3.1CRITICAL 9.1
- TI-2019-00283 Code injection in SAP Commerce Cloud CVSS 3.0HIGH 8.8
- TI-2019-00267 SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4… CVSS 3.0HIGH 7.5
- TI-2023-22645 Improper Access Control vulnerability in SAP Commerce Cloud CVSS 3.1HIGH 8.1
Sources
- CVE-2020-6238 · CVE Program
- CVE-2020-6238 · NVD
- FIRST EPSS
- GHSA-66x9-6gmr-h34w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences