Lucene search

SapCVELIST:CVE-2020-26809

HistoryNov 10, 2020 - 4:10 p.m.

CVE-2020-26809

2020-11-1016:10:56

sap

www.cve.org

sap commerce cloud

authentication bypass

permission checks

secure media folders

sensitive information disclosure

system configuration confidentiality

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

45.3%

JSON

SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the ‘/medias’ endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.

CNA Affected

[
  {
    "product": "SAP Commerce Cloud",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1808"
      },
      {
        "status": "affected",
        "version": "< 1811"
      },
      {
        "status": "affected",
        "version": "< 1905"
      },
      {
        "status": "affected",
        "version": "< 2005"
      }
    ]
  }
]

References

packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.html

seclists.org/fulldisclosure/2021/Jun/27

launchpad.support.sap.com/#/notes/2975189

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

45.3%

JSON

Related for CVELIST:CVE-2020-26809