CVE-2020-6363

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate active sessions that the user may have with SAP Commerce Cloud web applications, which gives an attacker the opportunity to reuse old session credentials, resulting in Insufficient Session Expiration.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
SAP SE	SAP Commerce Cloud	< 1808; < 1811; < 1905; < 2005

References

https://launchpad.support.sap.com/#/notes/2965287Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196Vendor Advisory
https://launchpad.support.sap.com/#/notes/2965287Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196Vendor Advisory

Timeline

Published: Oct 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-636410.0SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a co CVE-2020-63656.1SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect CVE-2020-63666.5SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with a CVE-2020-63676.1There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40,CVE-2020-63685.4SAP Business Planning and Consolidation, versions - 750, 751, 752, 753, 754, 755, 810, 100, 200, can be abused by an attacker, allowing them CVE-2020-63695.9SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attacke CVE-2020-63704.8SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, re CVE-2020-63714.3User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver CVE-2020-63727.8SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in cr CVE-2020-63737.8SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in cr CVE-2020-63747.8SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Jupiter Tessallation(.jt) file received from untrusted sourc CVE-2020-63755.5SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Right Computer Graphics Metafile (.cgm) file received from u