PT-2020-19057 · Sap · Abap Application Server

Published 2020-05-12 · Updated 2021-07-21 · CVE-2020-6262

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Application Server ABAP (ST-PI) versions prior to 2008 1 46C SAP Application Server ABAP (ST-PI) versions prior to 2008 1 620 SAP Application Server ABAP (ST-PI) versions prior to 2008 1 640 SAP Application Server ABAP (ST-PI) versions prior to 2008 1 700 SAP Application Server ABAP (ST-PI) versions prior to 2008 1 710 SAP Application Server ABAP (ST-PI) versions prior to 740

Description The issue allows an attacker to inject code that can be executed by the application, potentially controlling the behavior of the application and the whole ABAP system, leading to code injection.

Recommendations For versions prior to 2008 1 46C, update to version 2008 1 46C or later. For versions prior to 2008 1 620, update to version 2008 1 620 or later. For versions prior to 2008 1 640, update to version 2008 1 640 or later. For versions prior to 2008 1 700, update to version 2008 1 700 or later. For versions prior to 2008 1 710, update to version 2008 1 710 or later. For versions prior to 740, update to version 740 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-6262

Affected Products

Abap Application Server

References · 4

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=545396222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6262 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6262 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2835979 · Note