Unauthorized Access Vulnerability in SAP Solution Manager by SAP
CVE-2020-26821

10CRITICAL

Key Information:

Vendor
SAP
Status
SAP Solution Manager (java Stack)
Vendor
CVE Published:
10 November 2020

Summary

The vulnerability in SAP Solution Manager (JAVA stack) version 7.20 stems from missing authorization checks within the SVG Converter Service. This flaw can be exploited by unauthenticated attackers, allowing them to compromise the system integrity and availability. Proper authorization mechanisms are crucial to safeguarding the service from unauthorized access and ensuring its reliable operation.

Affected Version(s)

SAP Solution Manager (JAVA stack) < 7.20

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2985866
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.