CVE-2020-6319: 
SAP NetWeaver Application Server Java vulnerability analysis and mitigation

CVE-2020-6319 is a reflected cross-site scripting (XSS) vulnerability affecting SAP NetWeaver Application Server Java versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. The vulnerability was discovered and disclosed on January 8, 2020, allowing unauthenticated attackers to include JavaScript blocks in web pages or URLs with symbols that would otherwise not be allowed (MITRE CVE).

The vulnerability allows an unauthenticated attacker to inject JavaScript code into web pages through specially crafted URLs. The CVSS v3.1 base score for this vulnerability is 6.1 (Medium), with the following vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited remotely without authentication, requires user interaction, and can affect confidentiality and integrity with low impact (NVD).

On successful exploitation, an attacker can steal authentication information related to the user's current session and limitedly impact the confidentiality and integrity of the application. The vulnerability specifically allows attackers to capture user session data through injected JavaScript code (MITRE CVE).

The vulnerability requires no authentication to exploit but does need user interaction to be successful. An attacker can exploit this vulnerability by crafting specific URLs or web pages containing malicious JavaScript code that bypasses normal input restrictions (MITRE CVE).

SAP has released security patches for the affected versions of NetWeaver Application Server Java. Users are advised to apply the security note 2956398 to address this vulnerability (SAP Note).