CVE-2020-26829
CVSS V2 High 9
CVSS V3 Critical 10
Description
SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. As result, an unauthenticated attacker can invoke certain functions that would otherwise be restricted to system administrators only, including access to system administration functions or shutting down the system completely.
Overview
- CVE ID
- CVE-2020-26829
- Assigner
- cna@sap.com
- Vulnerability Status
- Analyzed
- Published Version
- 2020-12-09T17:15:31
- Last Modified Date
- 2021-07-21T11:39:23
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:sap:netweaver_application_server_java:7.11:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_java:7.20:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_java:7.31:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:P/I:P/A:C
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- COMPLETE
- Base Score
- 9
- Severity
- HIGH
- Exploitability Score
- 10
- Impact Score
- 8.5
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- CHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 10
- Base Severity
- CRITICAL
- Exploitability Score
- 3.9
- Impact Score
- 6
References
| Reference URL | Reference Tags |
|---|---|
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 | Vendor Advisory |
| https://launchpad.support.sap.com/#/notes/2974774 | Permissions Required Vendor Advisory |
| http://seclists.org/fulldisclosure/2021/Jun/33 | Mailing List Third Party Advisory |
| http://packetstormsecurity.com/files/163166/SAP-Netweaver-JAVA-7.50-Missing-Authorization.html | Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-26829 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26829 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 07:04:09 | Added to TrackCVE | |||
| 2022-12-05 17:50:38 | 2020-12-09T17:15Z | 2020-12-09T17:15:31 | CVE Published Date | updated |
| 2022-12-05 17:50:38 | 2021-07-21T11:39:23 | CVE Modified Date | updated | |
| 2022-12-05 17:50:38 | Analyzed | Vulnerability Status | updated |