HIGH🇵🇱 Wersja polska

CVE-2020-26832

CVSS 7.6v3.1pub. 2020-12-09upd. 2024-11-21

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

  • Sap Netweaver Application Server Abap

    APP
    Sap
    2011_1_6202011_1_6402011_1_7002011_1_7102011_1_7302011_1_7312011_1_7522020

  • Sap S\/4 Hana

    APP
    Sap
    101102103104105
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-22536CRITICAL10.0⚠ KEVPL ✓same product

Request Smuggling w SAP NetWeaver i SAP Web Dispatcher — CVSS 10.0

CVE-2026-0488CRITICAL9.9PL ✓same product

SAP CRM / S/4HANA Scripting Editor — nieautoryzowane wykonanie SQL

CVE-2026-0498CRITICAL9.1PL ✓same product

SAP S/4HANA: injection kodu ABAP/poleceń OS przez RFC z uprawnieniami admina

CVE-2023-40309CRITICAL9.8PL ✓same product

SAP CommonCryptoLib — brak weryfikacji autoryzacji, privilege escalation

CVE-2023-27500CRITICAL9.6PL ✓same product

SAP NetWeaver AS ABAP: path traversal w SAPRSBRO umożliwia nadpisanie plików systemowych