{
  "id": "CVE-2020-26808",
  "sourceIdentifier": "cna@sap.com",
  "published": "2020-11-10T17:15:13.327",
  "lastModified": "2022-07-01T19:11:48.797",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application."
    },
    {
      "lang": "es",
      "value": "SAP AS ABAP (DMIS), versiones: 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 y SAP S4 HANA (DMIS), versiones: 101, 102, 103, 104, 105, permite a un atacante autenticado inyectar c\u00f3digo arbitrario en el m\u00f3dulo de funci\u00f3n conllevando a una inyecci\u00f3n de c\u00f3digo que puede ser ejecutada en la aplicaci\u00f3n, lo que afecta la confidencialidad, disponibilidad e integridad de la aplicaci\u00f3n"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV30": [
      {
        "source": "cna@sap.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_620:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A646D1F-C309-4627-950A-699CA07F9510"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_640:*:*:*:*:*:*:*",
              "matchCriteriaId": "60CBD496-1762-4448-9910-CBCD1B5B658E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_700:*:*:*:*:*:*:*",
              "matchCriteriaId": "14393D9C-24E1-4F11-8A29-EA70F99F9CC7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_710:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1451F37-991D-49D9-BE5F-556BE49C968F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_730:*:*:*:*:*:*:*",
              "matchCriteriaId": "80BCF0A0-30F9-42DA-A9CA-766C64AF8830"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_731:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC5C81F3-C1D3-4AE3-B092-6BD1ACBDFE0C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2011_1_752:*:*:*:*:*:*:*",
              "matchCriteriaId": "A799BE75-B829-41BC-9405-70929091EB41"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_as_abap\\(dmis\\):2020:*:*:*:*:*:*:*",
              "matchCriteriaId": "775DB68D-D9F2-4BC8-A8FE-3EAE838D4E1E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):101:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CECA4D2-4AE8-4386-BF9B-4D846B960477"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):102:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F85E85C-5A52-4712-85FD-D409FFECE4F9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):103:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0E32F83-C8D3-4240-977E-056E01F2CC35"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):104:*:*:*:*:*:*:*",
              "matchCriteriaId": "70116335-8A5F-4B36-9951-007AF54DEBD4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sap:sap_s4_hana\\(dmis\\):105:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF69AC60-5827-40A3-AA60-4BFFE5036AA6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html",
      "source": "cna@sap.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "http://seclists.org/fulldisclosure/2022/May/42",
      "source": "cna@sap.com",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://launchpad.support.sap.com/#/notes/2973735",
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ]
    },
    {
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571",
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}