Critical severity · published Nov 10, 2020
CVE-2020-26823
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics…
10.0
CVSS
1.3%
EPSS
No
On KEV
Description
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics Agent Connection Service, this has an impact to the integrity and availability of the service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Solution Manager · Sap
7.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26823
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26823
Permissions Required
https://launchpad.support.sap.com/#/notes/2985866
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
More from Solution Manager
9.8
CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
10.0
CVE-2020-26824
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports…
10.0
CVE-2020-26822
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Outside Discovery…
10.0
CVE-2020-26821
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the SVG Converter…
9.8
CVE-2020-6198
SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources