CVE Vulnerability

CVE-2020-26832

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 7.8

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact COMPLETE

Scope

7.6 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 Vendor Advisory
https://launchpad.support.sap.com/#/notes/2993132 Permissions Required
http://seclists.org/fulldisclosure/2022/May/42 Exploit Mailing List
http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:sap:s/4_hana:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:s/4_hana:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:s/4_hana:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:s/4_hana:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:s/4_hana:101:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_640:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_700:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_710:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_730:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_731:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_752:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:2020:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:2011_1_620:*:*:*:*:*:*:*
Information

Published : 2020-12-09 05:15

Updated : 2022-10-05 02:21

NVD link : CVE-2020-26832

Mitre link : CVE-2020-26832

Products Affected
No products.
CWE
CWE-862