SAP SE SAP AS ABAP(DMIS)

CVE-2020-26808

CRITICAL 9.1

At a glance

Source: NVD
EPSS: EPSS 3.05 % · percentile 88 (2026-10-31)
State: PUBLISHED
Published: 2020-11-10 16:12 UTC
Updated: 2024-08-04 16:03 UTC
Assigner: sap
NVD status: Modified

Search on…

Description

SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.

References

Scores

Version	Score	Vector	Scored by
CVSS 3.0	CRITICAL 9.1	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	sap
CVSS 3.1	HIGH 7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.0	CRITICAL 9.1	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · cna@sap.com (Secondary)
CVSS 2.0	MEDIUM 6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2020-19344
GCVE · GCVE-0-2020-26808

CERT-FR advisories

CERTFR-2020-AVI-722 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_620:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_640:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_700:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_710:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_730:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_731:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_752:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_as_abap\(dmis\):2020:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):101:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):102:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):103:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):104:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):105:*:*:*:*:*:*:*

Affected products

Product	Versions
SAP SE · SAP AS ABAP(DMIS)	affected < 2011_1_620 ; affected < 2011_1_640 ; affected < 2011_1_700 ; affected < 2011_1_710 ; affected < 2011_1_730 ; affected < 2011_1_731
SAP SE · SAP S4 HANA(DMIS)	affected < 101 ; affected < 102 ; affected < 103 ; affected < 104 ; affected < 105

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 SAP SE SAP AS ABAP(DMIS)