CVE-2020-26808 (GCVE-0-2020-26808)
Vulnerability from cvelistv5 – Published: 2020-11-10 16:12 – Updated: 2024-08-04 16:03
VLAI?
Summary
SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.
Severity ?
9.1 (Critical)
CWE
- Code Injection
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| SAP SE | SAP AS ABAP(DMIS) |
Affected:
< 2011_1_620
Affected: < 2011_1_640 Affected: < 2011_1_700 Affected: < 2011_1_710 Affected: < 2011_1_730 Affected: < 2011_1_731 Affected: < 2011_1_752 Affected: < 2020 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:03:22.579Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://launchpad.support.sap.com/#/notes/2973735"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
},
{
"name": "20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2022/May/42"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "SAP AS ABAP(DMIS)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 2011_1_620"
},
{
"status": "affected",
"version": "\u003c 2011_1_640"
},
{
"status": "affected",
"version": "\u003c 2011_1_700"
},
{
"status": "affected",
"version": "\u003c 2011_1_710"
},
{
"status": "affected",
"version": "\u003c 2011_1_730"
},
{
"status": "affected",
"version": "\u003c 2011_1_731"
},
{
"status": "affected",
"version": "\u003c 2011_1_752"
},
{
"status": "affected",
"version": "\u003c 2020"
}
]
},
{
"product": "SAP S4 HANA(DMIS)",
"vendor": "SAP SE",
"versions": [
{
"status": "affected",
"version": "\u003c 101"
},
{
"status": "affected",
"version": "\u003c 102"
},
{
"status": "affected",
"version": "\u003c 103"
},
{
"status": "affected",
"version": "\u003c 104"
},
{
"status": "affected",
"version": "\u003c 105"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Code Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-19T17:06:23",
"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"shortName": "sap"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://launchpad.support.sap.com/#/notes/2973735"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
},
{
"name": "20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components)",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2022/May/42"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@sap.com",
"ID": "CVE-2020-26808",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "SAP AS ABAP(DMIS)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "2011_1_620"
},
{
"version_name": "\u003c",
"version_value": "2011_1_640"
},
{
"version_name": "\u003c",
"version_value": "2011_1_700"
},
{
"version_name": "\u003c",
"version_value": "2011_1_710"
},
{
"version_name": "\u003c",
"version_value": "2011_1_730"
},
{
"version_name": "\u003c",
"version_value": "2011_1_731"
},
{
"version_name": "\u003c",
"version_value": "2011_1_752"
},
{
"version_name": "\u003c",
"version_value": "2020"
}
]
}
},
{
"product_name": "SAP S4 HANA(DMIS)",
"version": {
"version_data": [
{
"version_name": "\u003c",
"version_value": "101"
},
{
"version_name": "\u003c",
"version_value": "102"
},
{
"version_name": "\u003c",
"version_value": "103"
},
{
"version_name": "\u003c",
"version_value": "104"
},
{
"version_name": "\u003c",
"version_value": "105"
}
]
}
}
]
},
"vendor_name": "SAP SE"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application."
}
]
},
"impact": {
"cvss": {
"baseScore": "9.1",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Code Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://launchpad.support.sap.com/#/notes/2973735",
"refsource": "MISC",
"url": "https://launchpad.support.sap.com/#/notes/2973735"
},
{
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571",
"refsource": "MISC",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
},
{
"name": "20220518 SEC Consult SA-20220518-0 :: Multiple Critical Vulnerabilities in SAP Application Server, ABAP and ABAP Platform (Different Software Components)",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2022/May/42"
},
{
"name": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
"assignerShortName": "sap",
"cveId": "CVE-2020-26808",
"datePublished": "2020-11-10T16:12:24",
"dateReserved": "2020-10-07T00:00:00",
"dateUpdated": "2024-08-04T16:03:22.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_620:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A646D1F-C309-4627-950A-699CA07F9510\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_640:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"60CBD496-1762-4448-9910-CBCD1B5B658E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_700:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"14393D9C-24E1-4F11-8A29-EA70F99F9CC7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_710:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C1451F37-991D-49D9-BE5F-556BE49C968F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_730:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80BCF0A0-30F9-42DA-A9CA-766C64AF8830\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_731:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BC5C81F3-C1D3-4AE3-B092-6BD1ACBDFE0C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_752:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A799BE75-B829-41BC-9405-70929091EB41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2020:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"775DB68D-D9F2-4BC8-A8FE-3EAE838D4E1E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):101:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4CECA4D2-4AE8-4386-BF9B-4D846B960477\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):102:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4F85E85C-5A52-4712-85FD-D409FFECE4F9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):103:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0E32F83-C8D3-4240-977E-056E01F2CC35\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):104:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"70116335-8A5F-4B36-9951-007AF54DEBD4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):105:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF69AC60-5827-40A3-AA60-4BFFE5036AA6\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.\"}, {\"lang\": \"es\", \"value\": \"SAP AS ABAP (DMIS), versiones: 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 y SAP S4 HANA (DMIS), versiones: 101, 102, 103, 104, 105, permite a un atacante autenticado inyectar c\\u00f3digo arbitrario en el m\\u00f3dulo de funci\\u00f3n conllevando a una inyecci\\u00f3n de c\\u00f3digo que puede ser ejecutada en la aplicaci\\u00f3n, lo que afecta la confidencialidad, disponibilidad e integridad de la aplicaci\\u00f3n\"}]",
"id": "CVE-2020-26808",
"lastModified": "2024-11-21T05:20:19.360",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}], \"cvssMetricV30\": [{\"source\": \"cna@sap.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 6.0}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2020-11-10T17:15:13.327",
"references": "[{\"url\": \"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html\", \"source\": \"cna@sap.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/May/42\", \"source\": \"cna@sap.com\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2973735\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2022/May/42\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2973735\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "cna@sap.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2020-26808\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2020-11-10T17:15:13.327\",\"lastModified\":\"2024-11-21T05:20:19.360\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.\"},{\"lang\":\"es\",\"value\":\"SAP AS ABAP (DMIS), versiones: 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 y SAP S4 HANA (DMIS), versiones: 101, 102, 103, 104, 105, permite a un atacante autenticado inyectar c\u00f3digo arbitrario en el m\u00f3dulo de funci\u00f3n conllevando a una inyecci\u00f3n de c\u00f3digo que puede ser ejecutada en la aplicaci\u00f3n, lo que afecta la confidencialidad, disponibilidad e integridad de la aplicaci\u00f3n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"cvssMetricV30\":[{\"source\":\"cna@sap.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_620:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A646D1F-C309-4627-950A-699CA07F9510\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_640:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60CBD496-1762-4448-9910-CBCD1B5B658E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_700:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14393D9C-24E1-4F11-8A29-EA70F99F9CC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_710:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1451F37-991D-49D9-BE5F-556BE49C968F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_730:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80BCF0A0-30F9-42DA-A9CA-766C64AF8830\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_731:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC5C81F3-C1D3-4AE3-B092-6BD1ACBDFE0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2011_1_752:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A799BE75-B829-41BC-9405-70929091EB41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_as_abap\\\\(dmis\\\\):2020:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"775DB68D-D9F2-4BC8-A8FE-3EAE838D4E1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):101:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CECA4D2-4AE8-4386-BF9B-4D846B960477\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):102:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F85E85C-5A52-4712-85FD-D409FFECE4F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):103:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0E32F83-C8D3-4240-977E-056E01F2CC35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):104:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70116335-8A5F-4B36-9951-007AF54DEBD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:sap_s4_hana\\\\(dmis\\\\):105:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF69AC60-5827-40A3-AA60-4BFFE5036AA6\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html\",\"source\":\"cna@sap.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/May/42\",\"source\":\"cna@sap.com\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2973735\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://seclists.org/fulldisclosure/2022/May/42\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2973735\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…