PT-2020-16516 · Sap · Sap As Abap+1

Alexander Meier + 1 · Published 2020-12-09 · Updated 2022-10-05 · CVE-2020-26832

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP AS ABAP (SAP Landscape Transformation) versions 2011 1 620 through 2020 SAP S4 HANA (SAP Landscape Transformation) versions 101 through 105

Description The issue allows a high privileged user to execute a RFC function module to which access should be restricted. Due to missing authorization, an attacker can get access to some sensitive internal information of the vulnerable SAP system or make the vulnerable SAP systems completely unavailable.

Recommendations For SAP AS ABAP (SAP Landscape Transformation) versions 2011 1 620 through 2020, restrict access to the RFC function module to minimize the risk of exploitation. For SAP S4 HANA (SAP Landscape Transformation) versions 101 through 105, restrict access to the RFC function module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-26832

Affected Products

Sap As Abap

Sap S/4Hana

References · 10

• 🔥 http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2022/May/42 · Exploit
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26832 · Security Note
• https://t.me/cibsecurity/17987 · Telegram Post
• https://t.me/cvenotify/6845 · Telegram Post
• https://t.me/cvenotify/6992 · Telegram Post
• https://t.me/cibsecurity/18007 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2993132 · Note