CVE-2020-26832

🗓️ 09 Dec 2020 16:31:03Reported by sapType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 57 Views

SAP AS ABAP and SAP S4 HANA versions allow high privileged user to execute RFC with missing authorizatio

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2020-26832	9 Dec 202020:32	–	circl
CNNVD	SAP AS ABAP 和 SAP S4 HANA 安全漏洞	8 Dec 202000:00	–	cnnvd
CNVD	SAP AS ABAP and SAP S4 HANA Improper Authentication Vulnerabilities	15 Dec 202000:00	–	cnvd
Cvelist	CVE-2020-26832	9 Dec 202016:31	–	cvelist
EUVD	EUVD-2020-19368	7 Oct 202500:30	–	euvd
NCSC	Vulnerabilities fixed in SAP products	8 Dec 202000:00	–	ncsc
NCSC	Vulnerabilities fixed in SAP products	9 Feb 202100:00	–	ncsc
NCSC	Vulnerabilities fixed in SAP Netweaver products	13 Apr 202100:00	–	ncsc
NVD	CVE-2020-26832	9 Dec 202017:15	–	nvd
Packet Storm	SAP Application Server ABAP / ABAP Platform Code Injection / SQL Injection / Missing Authorization	19 May 202200:00	–	packetstorm

NVD

Vulners

Node

sap netweaver_application_server_abapMatch2011_1_620

sap netweaver_application_server_abapMatch2011_1_640

sap netweaver_application_server_abapMatch2011_1_700

sap netweaver_application_server_abapMatch2011_1_710

sap netweaver_application_server_abapMatch2011_1_730

sap netweaver_application_server_abapMatch2011_1_731

sap netweaver_application_server_abapMatch2011_1_752

sap netweaver_application_server_abapMatch2020

sap s/4_hanaMatch101

sap s/4_hanaMatch102

sap s/4_hanaMatch103

sap s/4_hanaMatch104

sap s/4_hanaMatch105

[
  {
    "product": "SAP NetWeaver AS ABAP (SAP Landscape Transformation)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 2011_1_620"
      },
      {
        "status": "affected",
        "version": "< 2011_1_640"
      },
      {
        "status": "affected",
        "version": "< 2011_1_700"
      },
      {
        "status": "affected",
        "version": "< 2011_1_710"
      },
      {
        "status": "affected",
        "version": "< 2011_1_730"
      },
      {
        "status": "affected",
        "version": "< 2011_1_731"
      },
      {
        "status": "affected",
        "version": "< 2011_1_752"
      },
      {
        "status": "affected",
        "version": "< 2020"
      }
    ]
  },
  {
    "product": "SAP S4 HANA (SAP Landscape Transformation)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 101"
      },
      {
        "status": "affected",
        "version": "< 102"
      },
      {
        "status": "affected",
        "version": "< 103"
      },
      {
        "status": "affected",
        "version": "< 104"
      },
      {
        "status": "affected",
        "version": "< 105"
      }
    ]
  }
]

Source	Link
launchpad	www.launchpad.support.sap.com/
seclists	www.seclists.org/fulldisclosure/2022/May/42
wiki	www.wiki.scn.sap.com/wiki/pages/viewpage.action
packetstormsecurity	www.packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html