Vulnerability Description
SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. These operations can be used to Change the User Experience Monitoring configuration, obtain details about the configured SAP Solution Manager agents, Deploy a malicious User Experience Monitoring script.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Solution Manager | 7.20 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/163161/SAP-Solution-Manager-7.2-Missing-AutThird Party Advisory
- http://seclists.org/fulldisclosure/2021/Jun/29Mailing ListThird Party Advisory
- https://launchpad.support.sap.com/#/notes/2983204Permissions RequiredVendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079Vendor Advisory
- http://packetstormsecurity.com/files/163161/SAP-Solution-Manager-7.2-Missing-AutThird Party Advisory
- http://seclists.org/fulldisclosure/2021/Jun/29Mailing ListThird Party Advisory
- https://launchpad.support.sap.com/#/notes/2983204Permissions RequiredVendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079Vendor Advisory
FAQ
What is CVE-2020-26830?
CVE-2020-26830 is a vulnerability with a CVSS score of 8.1 (HIGH). SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker au...
How severe is CVE-2020-26830?
CVE-2020-26830 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-26830?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Solution Manager.