What is CVE-2020-26838?

CVE-2020-26838 is a critical-severity vulnerability in SAP Business Warehouse, classified under OS Command Injection. CVSS score: 9.1/10. Published 2020-12-09.

How severe is CVE-2020-26838?

Critical severity. CVSS v3 base score is 9.1 out of 10.

RCE in SAP Business Warehouse

CVE-2020-26838

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It is possible to craft a request which will result in the execution of Operating System commands leading to Code Injection vulnerability which could completely compromise the confidentiality, integrity and availability of the server and any data or other applications running on it.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.022 (80.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Sap Business_warehouse — versions 700, 701, 702
Sap Bw\/4hana — versions 100, 200
Sap Se Business Warehouse — versions < 700, < 701, < 702
Sap Se Bw4hana — versions < 100, < 200

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

cna@sap.com (x_refsource_MISC, Vendor Advisory)
cna@sap.com (Permissions Required, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-26838?: CVE-2020-26838 is a critical-severity vulnerability in SAP Business Warehouse, classified under OS Command Injection. CVSS score: 9.1/10. Published 2020-12-09.
How severe is CVE-2020-26838?: Critical severity. CVSS v3 base score is 9.1 out of 10.