SAP SE SAP AS ABAP(DMIS)

CVE-2020-26808

CRITICAL 9.1

En bref

Source: NVD
EPSS: EPSS 3.05 % · centile 88 (2026-11-01)
État: PUBLISHED
Publiée: 2020-11-10 16:12 UTC
Mise à jour: 2024-08-04 16:03 UTC
Attribuée par: sap
Statut NVD: Modified

Rechercher sur…

Description

SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.0	CRITICAL 9.1	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	sap
CVSS 3.1	HIGH 7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.0	CRITICAL 9.1	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · cna@sap.com (Secondary)
CVSS 2.0	MEDIUM 6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2020-19344
GCVE · GCVE-0-2020-26808

Avis du CERT-FR

CERTFR-2020-AVI-722 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_620:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_640:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_700:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_710:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_730:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_731:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_752:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2020:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):101:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):102:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):103:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):104:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):105:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
SAP SE · SAP AS ABAP(DMIS)	affected < 2011_1_620 ; affected < 2011_1_640 ; affected < 2011_1_700 ; affected < 2011_1_710 ; affected < 2011_1_730 ; affected < 2011_1_731
SAP SE · SAP S4 HANA(DMIS)	affected < 101 ; affected < 102 ; affected < 103 ; affected < 104 ; affected < 105

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 SAP SE SAP AS ABAP(DMIS)