CVE-2020-26808

published 2020-11-10

CVE-2020-26808: SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101…

Priority P3 47 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.

Affected

26 ranges · showing 25

Vendor	Product	Version range	Fixed in
sap	sap_as_abap	—	—
sap	sap_as_abap	—	—
sap	sap_as_abap	—	—
sap	sap_as_abap	—	—
sap	sap_as_abap	—	—
sap	sap_as_abap	—	—
sap	sap_as_abap	—	—
sap	sap_as_abap	—	—
sap	sap_s4_hana	—	—
sap	sap_s4_hana	—	—
sap	sap_s4_hana	—	—
sap	sap_s4_hana	—	—
sap	sap_s4_hana	—	—
sap_se	sap_as_abap	< 2011_1_620	2011_1_620
sap_se	sap_as_abap	< 2011_1_640	2011_1_640
sap_se	sap_as_abap	< 2011_1_700	2011_1_700
sap_se	sap_as_abap	< 2011_1_710	2011_1_710
sap_se	sap_as_abap	< 2011_1_730	2011_1_730
sap_se	sap_as_abap	< 2011_1_731	2011_1_731
sap_se	sap_as_abap	< 2011_1_752	2011_1_752
sap_se	sap_as_abap	< 2020	2020
sap_se	sap_s4_hana	< 101	101
sap_se	sap_s4_hana	< 102	102
sap_se	sap_s4_hana	< 103	103
sap_se	sap_s4_hana	< 104	104

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.1 CRITICAL CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94