Information Disclosure in SAP NetWeaver AS ABAP Web Dynpro by SAP
CVE-2020-26818

6.5MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver As Abap (web Dynpro)
Vendor
CVE Published:
10 November 2020

What is CVE-2020-26818?

SAP NetWeaver AS ABAP (Web Dynpro) versions 731, 740, 750, 751, 752, 753, 754, 755, and 782 contain a vulnerability that allows authenticated users to access Web Dynpro components. This access can expose sensitive system information, which would typically be restricted to users with higher privileges due to inadequate authorization checks. As a result, the vulnerability poses a significant risk of unintended information exposure, leading to potential misuse of privileged data.

Affected Version(s)

SAP NetWeaver AS ABAP (Web Dynpro) < 731 < 731

SAP NetWeaver AS ABAP (Web Dynpro) < 740 < 740

SAP NetWeaver AS ABAP (Web Dynpro) < 750 < 750

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2971954
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.