Read the docs
TI-2020-05176 Aliases CVE-2020-6324GHSA-c4pp-v922-7762

Cross-site scripting in SAP NetWeaver AS ABAP

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

SAP Netweaver AS ABAP(BSP Test Application sbspext_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send polluted URL to the victim, when the victim clicks on this URL, the attacker can read, modify the information available in the victim�s browser leading to Reflected Cross Site Scripting.

Why it matters now

EPSS 0.00895 59th percentileScored 2026-11-07
Fix Fixed SAP NetWeaver AS ABAP (BSP Test Application) (SAP SE): 700, 701, 702 +9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP NetWeaver AS ABAP (BSP Test Application)before 700; before 701; before 702; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755Patch availableCNA
  • SAP NetWeaver AS ABAP (BSP Test Application) VendorSAP Affected before 700; before 701; before 702; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755 Fixed in 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:700:*:*:*:*:*:*:*700VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:701:*:*:*:*:*:*:*701VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:702:*:*:*:*:*:*:*702VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:730:*:*:*:*:*:*:*730VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:731:*:*:*:*:*:*:*731VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:740:*:*:*:*:*:*:*740VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:750:*:*:*:*:*:*:*750VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:751:*:*:*:*:*:*:*751VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:752:*:*:*:*:*:*:*752VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:753:*:*:*:*:*:*:*753VulnerableSAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:754:*:*:*:*:*:*:*754VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:755:*:*:*:*:*:*:*755VulnerableSAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_business_server_pages:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP NetWeaver AS ABAP (BSP Test Application) (SAP SE) Fixed in 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6324
  2. 2026-10-03 Alias added: GHSA-c4pp-v922-7762

References

Advisory 2

  • TI-2023-13615 Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) CVSS 3.1MEDIUM 6.5
  • TI-2020-05071 Open redirect in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
  • TI-2020-05069 Cross-site scripting in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
  • TI-2020-05061 Cross-site scripting in SAP NetWeaver Application Server ABAP - SAP_BASIS CVSS 3.1MEDIUM 6.1
  • TI-2020-05102 Cross-site scripting in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
  • TI-2020-05085 Cross-site scripting in SAP NetWeaver AS ABAP CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences