CVE-2020-6313

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server JAVA(XML Forms) versions 7.30, 7.31, 7.40, 7.50 does not sufficiently encode user controlled inputs, which allows an authenticated User with special roles to store malicious content, that when accessed by a victim, can perform malicious actions by executing JavaScript, leading to Stored Cross-Site Scripting.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-79 CWE-116

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver AS JAVA (XML Forms)	< 7.30; < 7.31; < 7.40; < 7.50

References

https://launchpad.support.sap.com/#/notes/2953112Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700Vendor Advisory
https://launchpad.support.sap.com/#/notes/2953112Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700Vendor Advisory

Timeline

Published: Sep 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-63144.3SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated HPGL file received from untrusted sources which results in c CVE-2020-63155.5SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of CVE-2020-63164.3SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leadi CVE-2020-63173.5In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive inform CVE-2020-63187.2A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Becau CVE-2020-63196.1SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include CVE-2020-63208.1SAP Marketing (Servlet), version-130,140,150, allows an authenticated attacker to invoke certain functions that are restricted. Limited know CVE-2020-63216.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated U3D file received from untrusted sources which results in cr CVE-2020-63224.3SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated 3DM file received from untrusted sources which results in cr CVE-2020-63236.1SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50, 7.31, 7.40, does not sufficiently encode user-controlled inputs and CVE-2020-63246.1SAP Netweaver AS ABAP(BSP Test Application sbspext_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticate CVE-2020-63265.4SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, whe