CVE-2020-26832 | BDVDB-2026-145666 Detail
SAP SESAP NetWeaver AS ABAP (SAP Landscape Transformation)
Description#
SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable.
Impact#
Per CVSS v3.0: confidentiality impact low, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
No weakness recorded in the source data.
References#
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079
- https://launchpad.support.sap.com/#/notes/2993132
- http://seclists.org/fulldisclosure/2022/May/42
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.