mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-29 01:31:20 +00:00
211 lines
7.3 KiB
JSON
211 lines
7.3 KiB
JSON
|
{
|
||
|
|
"id": "CVE-2020-26808",
|
||
|
|
"sourceIdentifier": "cna@sap.com",
|
||
|
|
"published": "2020-11-10T17:15:13.327",
|
||
|
|
"lastModified": "2022-07-01T19:11:48.797",
|
||
|
|
"vulnStatus": "Analyzed",
|
||
|
|
"descriptions": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"lang": "es",
|
||
|
|
"value": "SAP AS ABAP (DMIS), versiones: 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 y SAP S4 HANA (DMIS), versiones: 101, 102, 103, 104, 105, permite a un atacante autenticado inyectar c\u00f3digo arbitrario en el m\u00f3dulo de funci\u00f3n conllevando a una inyecci\u00f3n de c\u00f3digo que puede ser ejecutada en la aplicaci\u00f3n, lo que afecta la confidencialidad, disponibilidad e integridad de la aplicaci\u00f3n"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"metrics": {
|
||
|
|
"cvssMetricV31": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "3.1",
|
||
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||
|
|
"attackVector": "NETWORK",
|
||
|
|
"attackComplexity": "LOW",
|
||
|
|
"privilegesRequired": "HIGH",
|
||
|
|
"userInteraction": "NONE",
|
||
|
|
"scope": "UNCHANGED",
|
||
|
|
"confidentialityImpact": "HIGH",
|
||
|
|
"integrityImpact": "HIGH",
|
||
|
|
"availabilityImpact": "HIGH",
|
||
|
|
"baseScore": 7.2,
|
||
|
|
"baseSeverity": "HIGH"
|
||
|
|
},
|
||
|
|
"exploitabilityScore": 1.2,
|
||
|
|
"impactScore": 5.9
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cvssMetricV30": [
|
||
|
|
{
|
||
|
|
"source": "cna@sap.com",
|
||
|
|
"type": "Secondary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "3.0",
|
||
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
||
|
|
"attackVector": "NETWORK",
|
||
|
|
"attackComplexity": "LOW",
|
||
|
|
"privilegesRequired": "HIGH",
|
||
|
|
"userInteraction": "NONE",
|
||
|
|
"scope": "CHANGED",
|
||
|
|
"confidentialityImpact": "HIGH",
|
||
|
|
"integrityImpact": "HIGH",
|
||
|
|
"availabilityImpact": "HIGH",
|
||
|
|
"baseScore": 9.1,
|
||
|
|
"baseSeverity": "CRITICAL"
|
||
|
|
},
|
||
|
|
"exploitabilityScore": 2.3,
|
||
|
|
"impactScore": 6.0
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cvssMetricV2": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"cvssData": {
|
||
|
|
"version": "2.0",
|
||
|
|
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
|
||
|
|
"accessVector": "NETWORK",
|
||
|
|
"accessComplexity": "LOW",
|
||
|
|
"authentication": "SINGLE",
|
||
|
|
"confidentialityImpact": "PARTIAL",
|
||
|
|
"integrityImpact": "PARTIAL",
|
||
|
|
"availabilityImpact": "PARTIAL",
|
||
|
|
"baseScore": 6.5
|
||
|
|
},
|
||
|
|
"baseSeverity": "MEDIUM",
|
||
|
|
"exploitabilityScore": 8.0,
|
||
|
|
"impactScore": 6.4,
|
||
|
|
"acInsufInfo": false,
|
||
|
|
"obtainAllPrivilege": false,
|
||
|
|
"obtainUserPrivilege": false,
|
||
|
|
"obtainOtherPrivilege": false,
|
||
|
|
"userInteractionRequired": false
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"weaknesses": [
|
||
|
|
{
|
||
|
|
"source": "nvd@nist.gov",
|
||
|
|
"type": "Primary",
|
||
|
|
"description": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "NVD-CWE-noinfo"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"configurations": [
|
||
|
|
{
|
||
|
|
"nodes": [
|
||
|
|
{
|
||
|
|
"operator": "OR",
|
||
|
|
"negate": false,
|
||
|
|
"cpeMatch": [
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_620:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "9A646D1F-C309-4627-950A-699CA07F9510"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_640:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "60CBD496-1762-4448-9910-CBCD1B5B658E"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_700:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "14393D9C-24E1-4F11-8A29-EA70F99F9CC7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_710:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "C1451F37-991D-49D9-BE5F-556BE49C968F"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_730:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "80BCF0A0-30F9-42DA-A9CA-766C64AF8830"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_731:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "BC5C81F3-C1D3-4AE3-B092-6BD1ACBDFE0C"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_752:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "A799BE75-B829-41BC-9405-70929091EB41"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2020:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "775DB68D-D9F2-4BC8-A8FE-3EAE838D4E1E"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):101:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "4CECA4D2-4AE8-4386-BF9B-4D846B960477"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):102:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "4F85E85C-5A52-4712-85FD-D409FFECE4F9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):103:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "F0E32F83-C8D3-4240-977E-056E01F2CC35"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):104:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "70116335-8A5F-4B36-9951-007AF54DEBD4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"vulnerable": true,
|
||
|
|
"criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):105:*:*:*:*:*:*:*",
|
||
|
|
"matchCriteriaId": "DF69AC60-5827-40A3-AA60-4BFFE5036AA6"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"references": [
|
||
|
|
{
|
||
|
|
"url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html",
|
||
|
|
"source": "cna@sap.com",
|
||
|
|
"tags": [
|
||
|
|
"Exploit",
|
||
|
|
"Third Party Advisory",
|
||
|
|
"VDB Entry"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "http://seclists.org/fulldisclosure/2022/May/42",
|
||
|
|
"source": "cna@sap.com",
|
||
|
|
"tags": [
|
||
|
|
"Exploit",
|
||
|
|
"Mailing List",
|
||
|
|
"Third Party Advisory"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://launchpad.support.sap.com/#/notes/2973735",
|
||
|
|
"source": "cna@sap.com",
|
||
|
|
"tags": [
|
||
|
|
"Permissions Required"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571",
|
||
|
|
"source": "cna@sap.com",
|
||
|
|
"tags": [
|
||
|
|
"Vendor Advisory"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|