// For flags

CVE-2020-26829

SAP Netweaver JAVA 7.50 Missing Authorization

Severity Score

10.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. As result, an unauthenticated attacker can invoke certain functions that would otherwise be restricted to system administrators only, including access to system administration functions or shutting down the system completely.

SAP NetWeaver AS JAVA (P2P Cluster Communication), versiones - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, permite conexiones arbitrarias de procesos debido a una falta de comprobación de autenticación, que están fuera del clúster e incluso fuera del segmento de red dedicado para la comunicación interna del clúster. Como resultado, un atacante no autenticado puede invocar determinadas funciones que de otro modo estarían restringidas sólo a los administradores del sistema, incluyendo el acceso a las funciones de administración del sistema o apagando el sistema por completo

A malicious unauthenticated user could abuse the lack of authentication check on SAP Java P2P cluster communication in order to connect to the respective TCP ports and perform different privileged actions. SAP Netweaver JAVA versions 7.10 through 7.50 are affected.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-10-07 CVE Reserved
  • 2020-12-09 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-10-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-306: Missing Authentication for Critical Function
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sap
Search vendor "Sap"
Netweaver Application Server Java
Search vendor "Sap" for product "Netweaver Application Server Java"
7.11
Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.11"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Java
Search vendor "Sap" for product "Netweaver Application Server Java"
7.20
Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.20"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Java
Search vendor "Sap" for product "Netweaver Application Server Java"
7.30
Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.30"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Java
Search vendor "Sap" for product "Netweaver Application Server Java"
7.31
Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.31"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Java
Search vendor "Sap" for product "Netweaver Application Server Java"
7.40
Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.40"
-
Affected
Sap
Search vendor "Sap"
Netweaver Application Server Java
Search vendor "Sap" for product "Netweaver Application Server Java"
7.50
Search vendor "Sap" for product "Netweaver Application Server Java" and version "7.50"
-
Affected