SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exploit an existing path traversal vulnerability to compromise confidentiality exposing elements of the file system, partially compromise integrity allowing the modification of some configurations and partially compromise availability by making certain services unavailable.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/163160/SAP-Solution-Manager-7.2-File-Disclosure-Denial-Of-Service.html | Third Party Advisory |
| http://seclists.org/fulldisclosure/2021/Jun/32 | Mailing List Third Party Advisory |
| https://launchpad.support.sap.com/#/notes/2983204 | Permissions Required Vendor Advisory |
| https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 | Vendor Advisory |
Configurations
History
17 Jun 2021, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://launchpad.support.sap.com/#/notes/2983204 - Permissions Required, Vendor Advisory | |
| References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Jun/32 - Mailing List, Third Party Advisory | |
| References | (MISC) http://packetstormsecurity.com/files/163160/SAP-Solution-Manager-7.2-File-Disclosure-Denial-Of-Service.html - Third Party Advisory |
15 Jun 2021, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Jun 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2020-12-09 17:15
Updated : 2023-12-10 13:41
NVD link : CVE-2020-26837
Mitre link : CVE-2020-26837
CVE.ORG link : CVE-2020-26837
JSON object : View
Products Affected
sap
- solution_manager
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')