PT-2020-16504 · Sap · Sap Netweaver As Abap

Published 2020-11-10 · Updated 2022-10-05 · CVE-2020-26819

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP (Web Dynpro) versions 731, 740, 750, 751, 752, 753, 754, 755, 782

Description The issue allows an authenticated user to access Web Dynpro components, enabling them to read and delete database logfiles due to Improper Access Control.

Recommendations For SAP NetWeaver AS ABAP (Web Dynpro) versions 731, 740, 750, 751, 752, 753, 754, 755, 782, consider restricting access to Web Dynpro components to prevent unauthorized reading and deletion of database logfiles until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-26819

Affected Products

Sap Netweaver As Abap

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-26819 · Security Note
• https://launchpad.support.sap.com/#/notes/2971954 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26819 · Vendor Advisory
• https://t.me/cibsecurity/16111 · Telegram Post