Auth bypass in SAP Netweaver Application Server Abap
CVE-2020-26832
SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.
Vulnerability class: Broken Access Control
EPSS: 0.022 (81.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H.
Affected products
- Sap Netweaver_application_server_abap — versions 2011_1_620, 2011_1_640, 2011_1_700
- Sap S\/4_hana — versions 101, 102, 103
- Sap Se Netweaver As Abap (Sap Landscape Transformation) — versions < 2011_1_620, < 2011_1_640, < 2011_1_700
- Sap Se S4 Hana (Sap Landscape Transformation) — versions < 101, < 102, < 103
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC)
- cna@sap.com (mailing-list, Exploit, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- cna@sap.com (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-26832?
- CVE-2020-26832 is a high-severity vulnerability in SAP Netweaver Application Server Abap, classified under Missing Authorization. CVSS score: 7.6/10. Published 2020-12-09.
- How severe is CVE-2020-26832?
- High severity. CVSS v3 base score is 7.6 out of 10.
- Is CVE-2020-26832 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.