CVE Vulnerability

CVE-2020-26815

SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

8.6 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://launchpad.support.sap.com/#/notes/2984627 Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:sap:fiori_launchpad_(news_tile_application):751:*:*:*:*:*:*:*
cpe:2.3:a:sap:fiori_launchpad_(news_tile_application):752:*:*:*:*:*:*:*
cpe:2.3:a:sap:fiori_launchpad_(news_tile_application):753:*:*:*:*:*:*:*
cpe:2.3:a:sap:fiori_launchpad_(news_tile_application):754:*:*:*:*:*:*:*
cpe:2.3:a:sap:fiori_launchpad_(news_tile_application):755:*:*:*:*:*:*:*
cpe:2.3:a:sap:fiori_launchpad_(news_tile_application):750:*:*:*:*:*:*:*
Information

Published : 2020-11-10 05:15

Updated : 2020-11-24 05:12

NVD link : CVE-2020-26815

Mitre link : CVE-2020-26815

Products Affected
No products.
CWE
CWE-918

Server-Side Request Forgery (SSRF)