TI-2020-05119 Aliases CVE-2020-6264 GHSA-mwr9-4jvv-9cxv

SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access…

LOW 35Published 2020-06-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP Commerce, versions - 6.7, 1808, 1811, 1905, may allow an attacker to access information under certain conditions which would otherwise be restricted, leading to Information Disclosure.

Why it matters now

EPSS 0.00972 62nd percentileScored 2026-11-07

Fix Fixed SAP Commerce (SAP SE): 6.7, 1808, 1811 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP Commerce	before 6.7; before 1808; before 1811; before 1905	6.7, 1808, 1811, 1905	Patch available	CNA

SAP Commerce VendorSAP Affected before 6.7; before 1808; before 1811; before 1905 Fixed in 6.7, 1808, 1811, 1905 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:commerce:6.7:::::::*	6.7	Vulnerable	SAP
cpe:2.3:a:sap:commerce:1808:::::::*	1808	Vulnerable	SAP
cpe:2.3:a:sap:commerce:1811:::::::*	1811	Vulnerable	SAP
cpe:2.3:a:sap:commerce:1905:::::::*	1905	Vulnerable	SAP

cpe:2.3:a:sap:commerce:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·SAP
cpe:2.3:a:sap:commerce:1808:*:*:*:*:*:*:* Versions 1808 Vulnerable ·SAP
cpe:2.3:a:sap:commerce:1811:*:*:*:*:*:*:* Versions 1811 Vulnerable ·SAP
cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:* Versions 1905 Vulnerable ·SAP

Remediation

Fix · CNA SAP Commerce (SAP SE) Fixed in 6.7, 1808, 1811, 1905

Timeline

2026-10-02 Threatist record created from CVE-2020-6264
2026-10-03 Alias added: GHSA-mwr9-4jvv-9cxv

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775

Other 1

https://launchpad.support.sap.com/#/notes/2906366

TI-2021-04575 Code injection in SAP Commerce CVSS 3.1CRITICAL 9.9
TI-2021-09054 Code injection in SAP Commerce CVSS 3.1CRITICAL 9.9
TI-2020-05120 Hard-coded credentials in SAP Commerce CVSS 3.1CRITICAL 9.8
TI-2021-18574 SQL injection in SAP Commerce CVSS 3.1CRITICAL 9.8
TI-2022-19716 Open redirect in SAP Commerce CVSS 3.1HIGH 8.8
TI-2021-17549 Missing authorization in SAP Commerce CVSS 3.1HIGH 8.8

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences