CVE-2020-26820

Katalog CVE

CVSS 7.2 · High EPSS 3,9%

Kerentanan Unrestricted Upload of File with Dangerous Type pada sap netweaver application server java. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the file system and upload a malicious file. The attacker or another user can then use a separate mechanism to execute OS commands through the uploaded file leading to Privilege Escalation and completely compromise the confidentiality, integrity and availability of the server operating system and any application running on it.

Rincian

Terbit di NVD

10 November 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

3,9% peluang dieksploitasi; lebih tinggi dari 90,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://launchpad.support.sap.com/#/notes/2979062 permissions required · advisory vendor
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 advisory vendor
• http://packetstormsecurity.com/files/162086/SAP-Java-OS-Remote-Code-Execution.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2021/Apr/7 mailing list · advisory pihak ketiga