What is CVE-2020-26823?

CVE-2020-26823 is a critical-severity vulnerability in Sap Solution_manager, classified under Missing Authentication for Critical Function. CVSS score: 10.0/10. Published 2020-11-10.

How severe is CVE-2020-26823?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Auth bypass in Sap Solution_manager

CVE-2020-26823

SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics Agent Connection Service, this has an impact to the integrity…

Vulnerability class: Broken Authentication

EPSS: 0.013 (66.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H.

Affected products

Sap Solution_manager — versions 7.20
Sap Se Solution Manager (Java Stack) — versions < 7.20

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-26823?: CVE-2020-26823 is a critical-severity vulnerability in Sap Solution_manager, classified under Missing Authentication for Critical Function. CVSS score: 10.0/10. Published 2020-11-10.
How severe is CVE-2020-26823?: Critical severity. CVSS v3 base score is 10.0 out of 10.