Improper Access Control Vulnerability in SAP NetWeaver AS ABAP
CVE-2020-26819

5.4MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver As Abap (web Dynpro)
Vendor
CVE Published:
10 November 2020

What is CVE-2020-26819?

SAP NetWeaver AS ABAP (Web Dynpro) versions 731 through 782 are susceptible to an improper access control issue. This vulnerability allows authenticated users to gain unauthorized access to Web Dynpro components, enabling them to read and delete sensitive database logfiles. This flaw underscores the need for robust access control mechanisms to safeguard critical application components from unauthorized manipulation.

Affected Version(s)

SAP NetWeaver AS ABAP (Web Dynpro) < 731 < 731

SAP NetWeaver AS ABAP (Web Dynpro) < 740 < 740

SAP NetWeaver AS ABAP (Web Dynpro) < 750 < 750

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2971954
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.