Riskcovery

CVE-2020-26838

State
Published
Severity
9.1 Critical
Published
Dec 9, 2020
Updated
Aug 4, 2024
Reserved
Oct 7, 2020

Read the record on cve.org

Description

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It is possible to craft a request which will result in the execution of Operating System commands leading to Code Injection vulnerability which could completely compromise the confidentiality, integrity and availability of the server and any data or other applications running on it.

Scores

CVSSScoreVectorSource
3.09.1 CriticalCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsap

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
SAP Business WarehouseSAP SE
  • < 700Affected
  • < 701Affected
  • < 702Affected
  • < 731Affected
  • < 740Affected
  • < 750Affected
  • < 751Affected
  • < 752Affected
  • < 753Affected
  • < 754Affected
  • < 755Affected
  • < 782Affected
SAP BW4HANASAP SE
  • < 100Affected
  • < 200Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.