Skip links

CVE-2020-26832 Missing Authorization check in SAP NetWeaver AS ABAP and SAP S4 HANA (SAP Landscape Transformation), SAP security note 2993132

Description

UPDATE 13th April 2021: This note has been re-released with updated ‘Correction instruction’ information.

UPDATE 26th January 2021: This note has been re-released with updated ‘Correction instruction’ information.

SAP Landscape Transformation allows a high privileged user to execute a RFC function module to which access should be restricted. This weakness gives attacker ability to read some sensitive internal information and also make vulnerable SAP systems completely unavailable.

Available fix and Supported packages

  • DMIS | 2011_1_620 | 2011_1_620
  • DMIS | 2011_1_640 | 2011_1_640
  • DMIS | 2011_1_700 | 2011_1_700
  • DMIS | 2011_1_710 | 2011_1_710
  • DMIS | 2011_1_730 | 2011_1_730
  • DMIS | 2011_1_731 | 2011_1_731
  • DMIS | 2018_1_752 | 2018_1_752
  • DMIS | 2020 | 2020
  • S4CORE | 100 | 100
  • S4CORE | 101 | 101
  • S4CORE | 102 | 102
  • S4CORE | 103 | 103
  • S4CORE | 104 | 104
  • S4CORE | 105 | 105
  • DMIS 2018_1_752 | SAPK-20105INDMIS |
  • DMIS 2011_1_620 | SAPK-11120INDMIS |
  • DMIS 2011_1_640 | SAPK-11220INDMIS |
  • DMIS 2011_1_710 | SAPK-11420INDMIS |
  • DMIS 2011_1_730 | SAPK-11520INDMIS |
  • DMIS 2011_1_731 | SAPK-11620INDMIS |
  • DMIS 2011_1_700 | SAPK-11320INDMIS |
  • DMIS 2020 | SAPK-20201INDMIS |
  • S4CORE 105 | SAPK-10501INS4CORE |
  • S4CORE 101 | SAPK-10110INS4CORE |
  • S4CORE 102 | SAPK-10208INS4CORE |
  • S4CORE 103 | SAPK-10306INS4CORE |
  • S4CORE 104 | SAPK-10404INS4CORE |
  • S4CORE 105 | SAPK-10502INS4CORE |

Affected component

    CA-DT-CNV
    Landscape Transformation for Conversion

CVSS

Score: 7.6
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2993132

TAGS

#Access-control
#Authorization-check
#Authorization-error
#Authorization-profile
#&160-CVE-2020-26832

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer

Initiating SAP Penetration Testing

►   Pentest, short for penetration testing, refers to a set of processes that simulate an attacker’s actions to identify security vulnerabilities. Companies

SAP Security Patch Day RedRays

May 2024 SAP Security Patch Day

Vulnerability: Multiple vulnerabilities in SAP CX Commerce SAP Component: CEC-SCC-PLA-PL CVE ID: CVE-2019-17495 CVSS Score: 9.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Category: Program error