{"api_version":"1","generated_at":"2026-07-23T14:00:17+00:00","cve":"CVE-2020-6206","urls":{"html":"https://cve.report/CVE-2020-6206","api":"https://cve.report/api/cve/CVE-2020-6206.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-6206","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-6206"},"summary":{"title":"CVE-2020-6206","description":"SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2020-03-10 21:15:00","updated_at":"2020-03-12 14:27:00"},"problem_types":["CWE-352"],"metrics":[],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305","refsource":"MISC","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – March 2020 - Product Security Response at SAP - Community Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://launchpad.support.sap.com/#/notes/2859004","name":"https://launchpad.support.sap.com/#/notes/2859004","refsource":"MISC","tags":["Permissions Required"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-6206","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6206","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"6206","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"cloud_platform_integration","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"data_services","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"6206","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"cloud_platform_integration","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"data_services","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-6206","ASSIGNER":"cna@sap.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"SAP SE","product":{"product_data":[{"product_name":"SAP Cloud Platform Integration for Data Services","version":{"version_data":[{"version_name":"<","version_value":"1.0"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery."}]},"impact":{"cvss":{"baseScore":"4.7","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross Site Request Forgery"}]}]},"references":{"reference_data":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305","refsource":"MISC","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305"},{"url":"https://launchpad.support.sap.com/#/notes/2859004","refsource":"MISC","name":"https://launchpad.support.sap.com/#/notes/2859004"}]}},"nvd":{"publishedDate":"2020-03-10 21:15:00","lastModifiedDate":"2020-03-12 14:27:00","problem_types":["CWE-352"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:cloud_platform_integration:1.0:*:*:*:*:data_services:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"6206","Ordinal":"166459","Title":"CVE-2020-6206","CVE":"CVE-2020-6206","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"6206","Ordinal":"1","NoteData":"SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"6206","Ordinal":"2","NoteData":"2020-03-10","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"6206","Ordinal":"3","NoteData":"2020-03-10","Type":"Other","Title":"Modified"}]}}}