CERT-In Advisory
CIAD-2020-0081
Multiple Vulnerabilities in SAP Products
Original Issue Date: November 19, 2020
Severity Rating: High
Software Affected
- SAP Solution Manager (JAVA stack), Version - 7.2
- SAP Solution Manager (User Experience Monitoring), Version - 7.2
- SAP Data Services, Versions - 4.2
- SAP S4 HANA(DMIS), Versions - 101, 102, 103, 104, 105
- SAP NetWeaver AS JAVA, Versions - 7.20, 7.30, 7.31, 7.40, 7.50
- SAP NetWeaver (Knowledge Management); Versions - 7.30, 7.31, 7.40, 7.50
- SAP Fiori Launchpad (News Tile Application), Versions - 750,751,752,753,754,755
- SAP Commerce Cloud, Versions - 1808,1811,1905,2005
- SAP Commerce Cloud (Accelerator Payment Mock), Versions - 1808, 1811, 1905, 2005
- SAP NetWeaver AS ABAP, Versions - 731, 740, 750, 751, 752, 753, 754, 755, 782
- BANKING SERVICES FROM SAP 9.0(Bank Analyzer), Version - 500
- S/4HANA FIN PROD SUBLDGR, Version - 100
- SAP Process Integration (PGP Module ¿ Business-to-Business Add On), Version - 1.0
- SAP ERP Client for E-Bilanz 1.0, Version - 1.0
- SAP ERP, Versions - 600, 602, 603, 604, 605, 606, 616, 617, 618
- SAP S/4 HANA, Versions - 100, 101, 102, 103, 104
- SAP 3D Visual Enterprise Viewer, Versions - 9
Overview
Multiple vulnerabilities have been reported in SAP products which could be exploited by remote attacker to perform Cross site scripting attacks, Server side request forgery attacks, remote code execution, information disclosure, gain escalation of privileges, perform unrestricted file upload and obtain sensitive information on the targeted system.
Description
These vulnerabilities exist due to insufficient authentication/authorization checks, insufficient sanitization of user-supplied data, inadequate filtering with the accessing user's privileges, various boundary errors, insufficient encoding of user-controlled inputs and other flaws in the affected software.
A remote attacker could exploit these vulnerabilities by executing arbitrary commands in the connected SMDAgents, sending specially crafted request over the network to a particular SAP Commerce module URL, bypassing existing authentication and permission checks via a special endpoint in SAP Commerce, thereby gaining access to Secure Media folders, executing arbitrary code, overriding access permissions thereby gaining access to confidential data on internal systems behind firewalls.
Successful exploitation of these vulnerabilities could allow an attacker to perform Cross site scripting attacks, Server side request forgery attacks, remote code execution, information disclosure, gain escalation of privileges, perform unrestricted file upload and obtain sensitive information on the targeted system.
Solution
Apply appropriate patches as mentioned on the SAP website
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
Vendor Information
SAP
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
References
SAP
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
Onapsis
https://onapsis.com/blog/sap-security-notes-november-2020
CVE Name
CVE-2020-26821
CVE-2020-26822
CVE-2020-26823
CVE-2020-26824
CVE-2020-6207
CVE-2020-26808
CVE-2020-26820
CVE-2020-6284
CVE-2020-26815
CVE-2020-26825
CVE-2020-26809
CVE-2020-26810
CVE-2020-26811
CVE-2020-26818
CVE-2020-26819
CVE-2020-6311
CVE-2020-26814
CVE-2020-26807
CVE-2020-6316
CVE-2020-26817
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|