VulnerabilityModified

CVE-2020-26808

HIGH 7.2EPSS 3.05%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 3.05% probability · 87th percentile
CISA KEV: Not listed
Affected: sap/sap as abap\(dmis\) · sap/sap s4 hana\(dmis\)
Source: cna@sap.com

References

http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2973735Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory
http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/May/42Exploit, Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2973735Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.