Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-26832

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.

Published

2020-12-09T17:15:31.260

Last Modified

2024-11-21T05:20:21.883

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.6 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

7.8

Weaknesses
  • Type: Primary
    CWE-862
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application sap netweaver_application_server_abap 2011_1_620 Yes
Application sap netweaver_application_server_abap 2011_1_640 Yes
Application sap netweaver_application_server_abap 2011_1_700 Yes
Application sap netweaver_application_server_abap 2011_1_710 Yes
Application sap netweaver_application_server_abap 2011_1_730 Yes
Application sap netweaver_application_server_abap 2011_1_731 Yes
Application sap netweaver_application_server_abap 2011_1_752 Yes
Application sap netweaver_application_server_abap 2020 Yes
Application sap s\/4_hana 101 Yes
Application sap s\/4_hana 102 Yes
Application sap s\/4_hana 103 Yes
Application sap s\/4_hana 104 Yes
Application sap s\/4_hana 105 Yes
References