CVE-2020-6302

CVE-2020-6302 is a session fixation vulnerability in SAP Commerce versions 6.7, 1808, 1811, 1905, and 2005, where the jSession ID is exposed in the backoffice URL upon initial application load. This allows an attacker, through methods like shoulder surfing or man-in-the-middle attacks, to capture the session ID. The vulnerability has a CVSS score of 8.1 (HIGH), indicating a high impact on confidentiality, integrity, and availability, with a network attack vector and high attack complexity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the KEV catalog, though it has received limited community discussion and media coverage.