CVE-2020-6302CWE-384

SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially

Medium · published September 9, 2020

CVSS v3.0
6.4
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the application.

The record
Technical detail
CVSS v3.0
6.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00805 · 56.3th percentile
Weakness
CWE-384 · Session Fixation
Published
2020-09-09T12:52Z
EPSS history
Timeline
  • 09 SEP 12:52Z
    SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially
    cvelistv5