CVE-2020-6266

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading to URL Redirection.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
SAP SE	SAP Fiori for SAP S/4HANA	< 200; < 300; < 400; < 500

References

https://launchpad.support.sap.com/#/notes/2911687Permissions Required, Vendor Advisory
https://launchpad.support.sap.com/#/notes/2911704Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775Vendor Advisory
https://launchpad.support.sap.com/#/notes/2911687Permissions Required, Vendor Advisory
https://launchpad.support.sap.com/#/notes/2911704Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775Vendor Advisory

Timeline

Published: Jun 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-62675.4Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only CVE-2020-62688.1Statutory Reporting for Insurance Companies in SAP ERP (EA-FINSERV versions - 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE version CVE-2020-62696.5Under certain conditions SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which wo CVE-2020-62706.5SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary autho CVE-2020-62718.2SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume CVE-2020-62725.4SAP Commerce Cloud versions - 1808, 1811, 1905, 2005, does not sufficiently encode user inputs, which allows an authenticated and authorized CVE-2020-62734.3SAP S/4 HANA (Fiori UI for General Ledger Accounting), versions 103, 104, does not perform necessary authorization checks for an authenticat CVE-2020-62759.8SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forg CVE-2020-62766.1SAP Business Objects Business Intelligence Platform (bipodata), version 4.2, does not sufficiently encode user-controlled inputs, resulting CVE-2020-62785.4SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), versions 4.1, 4.2, allows to an attacker to embed malicious scri CVE-2020-62802.7SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files whic CVE-2020-62816.1SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, result