CVE-2020-26837

Katalog CVE

CVSS 9.1 · Critical EPSS 1,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada sap solution manager. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exploit an existing path traversal vulnerability to compromise confidentiality exposing elements of the file system, partially compromise integrity allowing the modification of some configurations and partially compromise availability by making certain services unavailable.

Rincian

Terbit di NVD

9 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://launchpad.support.sap.com/#/notes/2983204 permissions required · advisory vendor
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 advisory vendor
• http://packetstormsecurity.com/files/163160/SAP-Solution-Manager-7.2-File-Disclosure-Denial-Of-Service.html advisory pihak ketiga
• http://seclists.org/fulldisclosure/2021/Jun/32 mailing list · advisory pihak ketiga