PT-2020-16512 · Sap · Sap Disclosure Management

Published 2020-12-09 · Updated 2020-12-11 · CVE-2020-26828

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Disclosure Management version 10.1

Description The issue allows authorized users to upload and download specific file types, some of which can contain formulas that call external applications or execute scripts. This could lead to the execution of a payload on the target machine, potentially resulting in data theft or modification within the spreadsheet.

Recommendations For SAP Disclosure Management version 10.1, consider restricting the upload and download of file types that can contain executable formulas or scripts until a fix is available. As a temporary workaround, limiting access to sensitive data within the spreadsheet can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-26828

Affected Products

Sap Disclosure Management

References · 19

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26828 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26828 · Security Note
• https://t.me/cibsecurity/18083 · Telegram Post
• https://t.me/cibsecurity/18064 · Telegram Post
• https://t.me/cibsecurity/18159 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2971180 · Note
• https://t.me/cibsecurity/18198 · Telegram Post
• https://t.me/cibsecurity/18276 · Telegram Post
• https://t.me/cibsecurity/18179 · Telegram Post
• https://t.me/cibsecurity/18217 · Telegram Post
• https://t.me/cibsecurity/18256 · Telegram Post
• https://t.me/cibsecurity/18026 · Telegram Post
• https://t.me/cibsecurity/18142 · Telegram Post
• https://t.me/cibsecurity/18006 · Telegram Post