Description
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775
Permissions Required x_refsource_misc
https://launchpad.support.sap.com/#/notes/2915126
Scores
CVSS v3
5.3
EPSS
0.0077
EPSS Percentile
50.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Details
CWE
CWE-91
Status
published
Products (1)
sap/solution_manager
7.20
Published
Jun 10, 2020
Tracked Since
Feb 18, 2026