PT-2020-19001
CVE-2020-6200
·
تاريخ النشر
2020-03-10
·
تاريخ التحديث
2020-03-11
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
SAP Commerce (SmartEdit Extension) versions 6.6, 6.7, 1808, 1811
Description
The issue is related to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that exploits the templating facilities of the angular framework.
Recommendations
For versions 6.6, 6.7, 1808, 1811, consider disabling the angularjs template injection functionality until a patch is available.
Restrict access to the templating facilities of the angular framework to minimize the risk of exploitation.
Avoid using the vulnerable angularjs template injection in the affected SAP Commerce (SmartEdit Extension) until the issue is resolved.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾