CVE-2020-26832

published 2020-12-09

CVE-2020-26832: SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA…

Priority P3 41 high 7.6 CVSS 3.1

AV N AC L PR H UI N S C C L I N A H

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.

Affected

26 ranges · showing 25

Vendor	Product	Version range	Fixed in
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	netweaver_application_server_abap	—	—
sap	s_4_hana	—	—
sap	s_4_hana	—	—
sap	s_4_hana	—	—
sap	s_4_hana	—	—
sap	s_4_hana	—	—
sap_se	sap_netweaver_as_abap	< 2011_1_620	2011_1_620
sap_se	sap_netweaver_as_abap	< 2011_1_640	2011_1_640
sap_se	sap_netweaver_as_abap	< 2011_1_700	2011_1_700
sap_se	sap_netweaver_as_abap	< 2011_1_710	2011_1_710
sap_se	sap_netweaver_as_abap	< 2011_1_730	2011_1_730
sap_se	sap_netweaver_as_abap	< 2011_1_731	2011_1_731
sap_se	sap_netweaver_as_abap	< 2011_1_752	2011_1_752
sap_se	sap_netweaver_as_abap	< 2020	2020
sap_se	sap_s4_hana	< 101	101
sap_se	sap_s4_hana	< 102	102
sap_se	sap_s4_hana	< 103	103
sap_se	sap_s4_hana	< 104	104

CVSS provenance

nvd v3.1 7.6 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

nvd v3.0 7.6 HIGH CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:S/C:P/I:N/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862