by Kastro
Paper/Archive/CVE-2020-26808

CVE-2020-26808

SAP SE SAP AS ABAP(DMIS) — SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DM…

EPSS 3%CVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 87.6.876 × 2017.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.

Affected

ProductAffectedFixed inSource
SAP AS ABAP(DMIS)< 2011_1_620–CNA
SAP AS ABAP(DMIS)< 2011_1_640–CNA
SAP AS ABAP(DMIS)< 2011_1_700–CNA
SAP AS ABAP(DMIS)< 2011_1_710–CNA
SAP AS ABAP(DMIS)< 2011_1_730–CNA
SAP AS ABAP(DMIS)< 2011_1_731–CNA
SAP AS ABAP(DMIS)< 2011_1_752–CNA
SAP AS ABAP(DMIS)< 2020–CNA
SAP S4 HANA(DMIS)< 101–CNA
SAP S4 HANA(DMIS)< 102–CNA
SAP S4 HANA(DMIS)< 103–CNA
SAP S4 HANA(DMIS)< 104–CNA

Scores by source

sap (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

reflaunchpad.support.sap.com/#/notes/2973735refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571refseclists.org/fulldisclosure/2022/May/42refpacketstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html