CVE-2020-26836
published 2020-12-09CVE-2020-26836: SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an…
PriorityP277medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.34%
81.7th percentile
SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | solution_manager | — | — |
| sap_se | sap_solution_manager | < 720 | 720 |
Detection & IOCsextracted from sources · hover to see the quote
- →Send a GET request to /sap/public/bc/icf/logoff?redirecturl=<external-url>; a vulnerable SAP Solution Manager 7.20 (ST-720) instance will respond with HTTP 301/302/307 and a Location header pointing to the attacker-controlled URL. ↗
- →Look for HTTP redirect responses (301/302/307) from the SAP logoff endpoint where the Location header reflects an externally supplied value from the 'redirecturl' query parameter — a strong indicator of exploitation. ↗
- →The vulnerable parameter is 'redirecturl' in the application URL of SAP Solution Manager Trace Analysis (version 720). Monitor web access logs for requests to /sap/public/bc/icf/logoff containing external domains in the redirecturl parameter. ↗
- ·The vulnerability affects SAP Solution Manager version 7.20 (ST-720) only. Confirm the target CPE before applying detections. ↗
- ·The open redirect is triggered via the logoff endpoint, meaning exploitation requires user interaction (UI:R) — the attacker must trick a user into clicking a crafted link. Automated scanning without a live redirect-catching server (e.g., interactsh) may produce false negatives. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv3.03.4LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v865-wgvp-j2q9: SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability,
ghsa_unreviewed·2022-05-24
CVE-2020-26836 [MEDIUM] CWE-601 GHSA-v865-wgvp-j2q9: SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability,
SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack.
VulnCheck
SAP Solution Manager URL Redirection to Untrusted Site ('Open Redirect')
vulncheck·2020·CVSS 6.1
CVE-2020-26836 [MEDIUM] SAP Solution Manager URL Redirection to Untrusted Site ('Open Redirect')
SAP Solution Manager URL Redirection to Untrusted Site ('Open Redirect')
SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack.
Affected: SAP Solution Manager
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://app.crowdsec.net/cti/cve-explorer/CVE-2020-26836
No detection rules found.
Nuclei
SAP Solution Manager - Open Redirect
nuclei·CVSS 6.1
CVE-2020-26836 [MEDIUM] SAP Solution Manager - Open Redirect
SAP Solution Manager - Open Redirect
SAP Solution Manager contains an open redirect vulnerability via the logoff endpoint. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
Template:
id: CVE-2020-26836
info:
name: SAP Solution Manager - Open Redirect
author: Gal Nagli,LRVT
severity: medium
description: SAP Solution Manager contains an open redirect vulnerability via the logoff endpoint. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
impact: |
Attackers can redirect users to malicious websites through crafted links, potentially facilitating phishing attacks or credential theft.
remediation:
No writeups or analysis indexed.
http://packetstormsecurity.com/files/163136/SAP-Solution-Manager-7.2-ST-720-Open-Redirection.htmlhttp://seclists.org/fulldisclosure/2021/Jun/25https://launchpad.support.sap.com/#/notes/2938650https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079http://packetstormsecurity.com/files/163136/SAP-Solution-Manager-7.2-ST-720-Open-Redirection.htmlhttp://seclists.org/fulldisclosure/2021/Jun/25https://launchpad.support.sap.com/#/notes/2938650https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079
2020-12-09
Published
Exploited in the wild