Code Injection Vulnerability in SAP Business Warehouse Affecting Multiple Versions
CVE-2020-26838
9.1CRITICAL
Key Information:
- Vendor
- SAP
- Vendor
- CVE Published:
- 9 December 2020
Summary
An authenticated attacker with elevated developer privileges in SAP Business Warehouse can exploit a vulnerability to craft requests that execute arbitrary Operating System commands. This code injection flaw poses significant risks, compromising the confidentiality, integrity, and availability of the affected server and all data and applications running on it. Organizations need to be aware of this vulnerability and take appropriate measures to mitigate potential security breaches.
Affected Version(s)
SAP Business Warehouse < 700 < 700
SAP Business Warehouse < 701 < 701
SAP Business Warehouse < 702 < 702
References
CVSS V3.1
Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved