Vulnerability Details CVE-2020-6220
BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Exploit is possible only when the bttoken in victim’s session is active.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 36.2%
CVSS Severity
CVSS v3 Score 4.4
CVSS v2 Score 2.6
References
Products affected by CVE-2020-6220
-
cpe:2.3:a:sap:business_objects_business_intelligence_platform:4.1
-
cpe:2.3:a:sap:business_objects_business_intelligence_platform:4.2