CVE-2020-6238

CRITICAL

SAP Commerce Cloud 6.6, 6.7, 1808, 1811, 1905 - XML External Entity Injection in Rest API Servlet xyformsweb

Title source: llm

Description

SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce.

References (2)

Core 2

Core References

Broken Link, Vendor Advisory x_refsource_misc

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202

Permissions Required, Vendor Advisory x_refsource_misc

https://launchpad.support.sap.com/#/notes/2904480

Scores

CVSS v3 9.3

EPSS 0.0041

EPSS Percentile 61.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Details

CWE

CWE-611

Status published

Products (5)

sap/commerce_cloud 6.6

sap/commerce_cloud 6.7

sap/commerce_cloud 1808

sap/commerce_cloud 1811

sap/commerce_cloud 1905

Published Apr 14, 2020

Tracked Since Feb 18, 2026