CVE-2020-26824

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports Service, this has an impact to the integrity and availability of the service.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
SAP SE	SAP Solution Manager (JAVA stack)	< 7.20

References

https://launchpad.support.sap.com/#/notes/2985866Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory
https://launchpad.support.sap.com/#/notes/2985866Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory

Timeline

Published: Nov 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-268256.1SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad CVE-2020-268266.5Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including scrip CVE-2020-268286.4SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. CVE-2020-2682910.0SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processe CVE-2020-26835.4Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). Suppor CVE-2020-268308.1SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated u CVE-2020-268319.6SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crys CVE-2020-268327.6SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2 CVE-2020-268345.4SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It i CVE-2020-268356.1SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input maliciou CVE-2020-268366.1SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulne CVE-2020-268379.1SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exp