CVE-2020-26829

Katalog CVE

CVSS 10.0 · Critical EPSS 4,8%

Kerentanan Missing Authentication for Critical Function pada sap netweaver application server java. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. As result, an unauthenticated attacker can invoke certain functions that would otherwise be restricted to system administrators only, including access to system administration functions or shutting down the system completely.

Rincian

Terbit di NVD

9 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

4,8% peluang dieksploitasi; lebih tinggi dari 91,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://launchpad.support.sap.com/#/notes/2974774 permissions required · advisory vendor
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 advisory vendor
• http://packetstormsecurity.com/files/163166/SAP-Netweaver-JAVA-7.50-Missing-Authorization.html advisory pihak ketiga
• http://seclists.org/fulldisclosure/2021/Jun/33 mailing list · advisory pihak ketiga