What is CVE-2020-26818?

CVE-2020-26818 is a high-severity vulnerability in SAP Netweaver Application Server Abap, classified under Missing Authorization. CVSS score: 8.8/10. Published 2020-11-10.

How severe is CVE-2020-26818?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2020-26818 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in SAP Netweaver Application Server Abap

CVE-2020-26818

SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, which reveals sensitive system information that would otherwise be restricted to highly privileged users because of missing authorization, resulting in Information Disclosure.

Vulnerability class: Broken Access Control

EPSS: 0.012 (64.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sap Netweaver_application_server_abap — versions 731, 740, 750
Sap Se Netweaver As Abap (Web Dynpro) — versions < 731, < 740, < 750

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2020-26818

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-26818?: CVE-2020-26818 is a high-severity vulnerability in SAP Netweaver Application Server Abap, classified under Missing Authorization. CVSS score: 8.8/10. Published 2020-11-10.
How severe is CVE-2020-26818?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2020-26818 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.