Cross-site scripting in SAP Business Planning and Consolidation
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users, leading to Cross Site Scripting.
Why it matters now
EPSS 0.0061 49th percentileScored 2026-11-07
Fix Fixed SAP Business Planning and Consolidation (SAP SE): 750, 751, 752 +6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Business Planning and Consolidation | before 750; before 751; before 752; before 753; before 754; before 755; before 810; before 100; before 200 | 750, 751, 752, 753, 754, 755, 810, 100, 200 | Patch available | CNA |
- SAP Business Planning and Consolidation VendorSAP Affected before 750; before 751; before 752; before 753; before 754; before 755; before 810; before 100; before 200 Fixed in 750, 751, 752, 753, 754, 755, 810, 100, 200 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:business_planning_and_consolidation:100:*:*:*:*:*:*:* | 100 | Vulnerable | SAP |
| cpe:2.3:a:sap:business_planning_and_consolidation:200:*:*:*:*:*:*:* | 200 | Vulnerable | SAP |
| cpe:2.3:a:sap:business_planning_and_consolidation:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:business_planning_and_consolidation:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:business_planning_and_consolidation:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
| cpe:2.3:a:sap:business_planning_and_consolidation:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
| cpe:2.3:a:sap:business_planning_and_consolidation:754:*:*:*:*:*:*:* | 754 | Vulnerable | SAP |
| cpe:2.3:a:sap:business_planning_and_consolidation:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:business_planning_and_consolidation:810:*:*:*:*:*:*:* | 810 | Vulnerable | SAP |
- cpe:2.3:a:sap:business_planning_and_consolidation:100:*:*:*:*:*:*:* Versions 100 Vulnerable ·SAP
- cpe:2.3:a:sap:business_planning_and_consolidation:200:*:*:*:*:*:*:* Versions 200 Vulnerable ·SAP
- cpe:2.3:a:sap:business_planning_and_consolidation:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:business_planning_and_consolidation:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:business_planning_and_consolidation:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
- cpe:2.3:a:sap:business_planning_and_consolidation:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
- cpe:2.3:a:sap:business_planning_and_consolidation:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
- cpe:2.3:a:sap:business_planning_and_consolidation:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:business_planning_and_consolidation:810:*:*:*:*:*:*:* Versions 810 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Business Planning and Consolidation (SAP SE) Fixed in 750, 751, 752, 753, 754, 755, 810, 100, 200
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6368
- 2026-10-03 Alias added: GHSA-hrc5-9pp2-965p
References
More SAP Business Planning And Consolidation vulnerabilities
- TI-2023-00016 SQL Injection vulnerability in SAP Business Planning and Consolidation MS CVSS 3.1CRITICAL 9.9
- TI-2022-19775 Improper privilege management in SAP Business Planning and Consolidation CVSS 3.1HIGH 8.5
- TI-2017-12058 XML external entity injection in Insteon SAP CVSS 3.1HIGH 8.1
- TI-2023-15025 Cross-Site Scripting (XSS) vulnerability in SAP Business Planning and Consolidation CVSS 3.1MEDIUM 5.4
- TI-2023-09650 Unrestricted file upload in SAP Business Planning and Consolidation CVSS 3.1MEDIUM 5.4
Sources
- CVE-2020-6368 · CVE Program
- CVE-2020-6368 · NVD
- FIRST EPSS
- GHSA-hrc5-9pp2-965p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences