Lucene search

SapCVELIST:CVE-2020-26824

HistoryNov 10, 2020 - 4:16 p.m.

CVE-2020-26824

2020-11-1016:16:44

sap

www.cve.org

sap solution manager

java stack

cve-2020-26824

authorization checks

integrity

availability

upgrade legacy ports service

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports Service, this has an impact to the integrity and availability of the service.

CNA Affected

[
  {
    "product": "SAP Solution Manager (JAVA stack)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.20"
      }
    ]
  }
]

References

launchpad.support.sap.com/#/notes/2985866

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Related for CVELIST:CVE-2020-26824