PT-2020-16494 · Sap · Sap Erp Client For E-Bilanz

Published 2020-11-10 · Updated 2020-11-24 · CVE-2020-26807

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP ERP Client for E-Bilanz version 1.0

Description The issue concerns incorrect default filesystem permissions set in the installation folder of the SAP ERP Client for E-Bilanz, allowing anyone to modify the files in the folder.

Recommendations For SAP ERP Client for E-Bilanz version 1.0, consider changing the default filesystem permissions in the installation folder to restrict access and prevent unauthorized modifications. As a temporary workaround, restrict access to the installation folder to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-26807

Affected Products

Sap Erp Client For E-Bilanz

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-26807 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26807 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2971112 · Note
• https://t.me/cibsecurity/16102 · Telegram Post