cnvd - cnvd-2020-65559

CNVD-2020-65559

Vulnerability from cnvd - Published: 2020-11-23

Title

SAP Business Planning and Consolidation跨站脚本漏洞

Description

SAP Business Planning and Consolidation是德国思爱普（SAP）公司的一款商业计划和整合软件。该软件提供预算编制、预测和财务合并功能。 SAP Business Planning and Consolidation 750、751、752、753、754、755、810、100和200版本存在跨站脚本漏洞。攻击者可利用该漏洞在未经授权的情况下修改显示的应用程序内容及从其它合法用户处获取身份验证信息。

Severity

低

Patch Name

SAP Business Planning and Consolidation跨站脚本漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196

Reference

https://vigilance.fr/vulnerability/SAP-multiple-vulnerabilities-of-October-2020-33549

Impacted products

Name
['SAP SAP Business Planning and Consolidation 750', 'SAP SAP Business Planning and Consolidation 751', 'SAP SAP Business Planning and Consolidation 752', 'SAP SAP Business Planning and Consolidation 753', 'SAP SAP Business Planning and Consolidation 754', 'SAP SAP Business Planning and Consolidation 755', 'SAP SAP Business Planning and Consolidation 810', 'SAP SAP Business Planning and Consolidation 100', 'SAP SAP Business Planning and Consolidation 200']

Name

['SAP SAP Business Planning and Consolidation 750', 'SAP SAP Business Planning and Consolidation 751', 'SAP SAP Business Planning and Consolidation 752', 'SAP SAP Business Planning and Consolidation 753', 'SAP SAP Business Planning and Consolidation 754', 'SAP SAP Business Planning and Consolidation 755', 'SAP SAP Business Planning and Consolidation 810', 'SAP SAP Business Planning and Consolidation 100', 'SAP SAP Business Planning and Consolidation 200']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-6368",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-6368"
    }
  },
  "description": "SAP Business Planning and Consolidation\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5546\u4e1a\u8ba1\u5212\u548c\u6574\u5408\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u63d0\u4f9b\u9884\u7b97\u7f16\u5236\u3001\u9884\u6d4b\u548c\u8d22\u52a1\u5408\u5e76\u529f\u80fd\u3002\n\nSAP Business Planning and Consolidation 750\u3001751\u3001752\u3001753\u3001754\u3001755\u3001810\u3001100\u548c200\u7248\u672c\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u672a\u7ecf\u6388\u6743\u7684\u60c5\u51b5\u4e0b\u4fee\u6539\u663e\u793a\u7684\u5e94\u7528\u7a0b\u5e8f\u5185\u5bb9\u53ca\u4ece\u5176\u5b83\u5408\u6cd5\u7528\u6237\u5904\u83b7\u53d6\u8eab\u4efd\u9a8c\u8bc1\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1ahttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-65559",
  "openTime": "2020-11-23",
  "patchDescription": "SAP Business Planning and Consolidation\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5546\u4e1a\u8ba1\u5212\u548c\u6574\u5408\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u63d0\u4f9b\u9884\u7b97\u7f16\u5236\u3001\u9884\u6d4b\u548c\u8d22\u52a1\u5408\u5e76\u529f\u80fd\u3002\r\n\r\nSAP Business Planning and Consolidation 750\u3001751\u3001752\u3001753\u3001754\u3001755\u3001810\u3001100\u548c200\u7248\u672c\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u672a\u7ecf\u6388\u6743\u7684\u60c5\u51b5\u4e0b\u4fee\u6539\u663e\u793a\u7684\u5e94\u7528\u7a0b\u5e8f\u5185\u5bb9\u53ca\u4ece\u5176\u5b83\u5408\u6cd5\u7528\u6237\u5904\u83b7\u53d6\u8eab\u4efd\u9a8c\u8bc1\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP Business Planning and Consolidation\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP SAP Business Planning and Consolidation 750",
      "SAP SAP Business Planning and Consolidation 751",
      "SAP SAP Business Planning and Consolidation 752",
      "SAP SAP Business Planning and Consolidation 753",
      "SAP SAP Business Planning and Consolidation 754",
      "SAP SAP Business Planning and Consolidation 755",
      "SAP SAP Business Planning and Consolidation 810",
      "SAP SAP Business Planning and Consolidation 100",
      "SAP SAP Business Planning and Consolidation 200"
    ]
  },
  "referenceLink": "https://vigilance.fr/vulnerability/SAP-multiple-vulnerabilities-of-October-2020-33549",
  "serverity": "\u4f4e",
  "submitTime": "2020-10-21",
  "title": "SAP Business Planning and Consolidation\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2020-6368 (GCVE-0-2020-6368)

Vulnerability from cvelistv5 – Published: 2020-10-15 01:54 – Updated: 2024-08-04 09:02

Summary

SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users, leading to Cross Site Scripting.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

Cross Site Scripting

Assigner

sap

References

URL

Tags

	https://wiki.scn.sap.com/wiki/pages/viewpage.acti…	x_refsource_MISC
	https://launchpad.support.sap.com/#/notes/2960825	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	SAP SE	SAP Business Planning and Consolidation	Affected: < 750 Affected: < 751 Affected: < 752 Affected: < 753 Affected: < 754 Affected: < 755 Affected: < 810 Affected: < 100 Affected: < 200

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:02:40.215Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2960825"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP Business Planning and Consolidation",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 750"
            },
            {
              "status": "affected",
              "version": "\u003c 751"
            },
            {
              "status": "affected",
              "version": "\u003c 752"
            },
            {
              "status": "affected",
              "version": "\u003c 753"
            },
            {
              "status": "affected",
              "version": "\u003c 754"
            },
            {
              "status": "affected",
              "version": "\u003c 755"
            },
            {
              "status": "affected",
              "version": "\u003c 810"
            },
            {
              "status": "affected",
              "version": "\u003c 100"
            },
            {
              "status": "affected",
              "version": "\u003c 200"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users, leading to Cross Site Scripting."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-15T01:54:18",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2960825"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2020-6368",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP Business Planning and Consolidation",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "750"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "751"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "752"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "753"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "754"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "755"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "810"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "100"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "200"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users, leading to Cross Site Scripting."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.4",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross Site Scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2960825",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/2960825"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2020-6368",
    "datePublished": "2020-10-15T01:54:18",
    "dateReserved": "2020-01-08T00:00:00",
    "dateUpdated": "2024-08-04T09:02:40.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-65559

CVE-2020-6368 (GCVE-0-2020-6368)

Tags

Sightings

Nomenclature