CVE-2020-6302 json
SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially.
published 2020-09-09 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-27452
- cvss
- 6.4
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
SAP Commerce versions 6.7, 1808, 1811, 1905, 2005 contains the jSession ID in the backoffice URL when the application is loaded initially. An attacker can get this session ID via shoulder surfing or man in the middle attack and subsequently get access to admin user accounts, leading to Session Fixation and complete compromise of the confidentiality, integrity and availability of the application.
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 6.4 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- SAP SE SAP Commerce
Classification
- Weakness
-
- CWE-384 Session Fixation
References
-
wiki.scn.sap.com
/wiki/pages/viewpage.action?pageId=557449700
vendor-advisory
-
launchpad.support.sap.com
/#/notes/2934451
permissions-required
Sources
- CVE List CVE-2020-6302
- NVD CVE-2020-6302
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.