Lucene search

SapCVELIST:CVE-2020-26823

HistoryNov 10, 2020 - 4:17 p.m.

CVE-2020-26823

2020-11-1016:17:49

sap

www.cve.org

sap

solution manager

java stack

missing authorization checks

upgrade diagnostics agent

service integrity

service availability

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics Agent Connection Service, this has an impact to the integrity and availability of the service.

CNA Affected

[
  {
    "product": "SAP Solution Manager (JAVA stack)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.20"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2985866

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Related for CVELIST:CVE-2020-26823