Lucene search

[email protected]CVE-2020-26832

HistoryDec 09, 2020 - 5:15 p.m.

CVE-2020-26832

2020-12-0917:15:00

CWE-862

[email protected]

web.nvd.nist.gov

sap

as abap

sap landscape transformation

sap s4 hana

cve-2020-26832

nvd

information security

authorization

rfc

vulnerability

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:P/I:N/A:C

0.012 Low

EPSS

Percentile

85.1%

JSON

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.

CPENameOperatorVersion
sap:s\/4_hanasap s\/4 hanaeq102
sap:s\/4_hanasap s\/4 hanaeq103
sap:s\/4_hanasap s\/4 hanaeq104
sap:s\/4_hanasap s\/4 hanaeq105
sap:s\/4_hanasap s\/4 hanaeq101
sap:netweaver_application_server_abapsap netweaver application server abapeq2011_1_640
sap:netweaver_application_server_abapsap netweaver application server abapeq2011_1_700
sap:netweaver_application_server_abapsap netweaver application server abapeq2011_1_710
sap:netweaver_application_server_abapsap netweaver application server abapeq2011_1_730
sap:netweaver_application_server_abapsap netweaver application server abapeq2011_1_731

CPE	Name	Operator	Version
sap:s\/4_hana	sap s\/4 hana	eq	102
sap:s\/4_hana	sap s\/4 hana	eq	103
sap:s\/4_hana	sap s\/4 hana	eq	104
sap:s\/4_hana	sap s\/4 hana	eq	105
sap:s\/4_hana	sap s\/4 hana	eq	101
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	2011_1_640
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	2011_1_700
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	2011_1_710
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	2011_1_730
sap:netweaver_application_server_abap	sap netweaver application server abap	eq	2011_1_731

Rows per page:

1-10 of 131

References

packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html

seclists.org/fulldisclosure/2022/May/42

launchpad.support.sap.com/#/notes/2993132

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079

Social References

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

9 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:P/I:N/A:C

0.012 Low

EPSS

Percentile

85.1%

JSON

Related for CVE-2020-26832

prion1 cvelist1 packetstorm1