CVE-2020-6220

BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting…

Medium · published June 6, 2022

CVSS v3.0
4.4
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Exploit is possible only when the bttoken in victim’s session is active.

The record
Technical detail
CVSS v3.0
4.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.0th percentile
Published
2022-06-06T19:45Z
EPSS history
Timeline
  • 06 JUN 19:45Z
    BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting…
    cvelistv5