CVE-2020-26810
Last modified
CVE-2020-26810 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerce service itself unavailable leading to Denial of Service with no impact on confidentiality or integrity.. EPSS estimates a 1.12% chance of exploitation in the next 30 days.
Description
SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerce service itself unavailable leading to Denial of Service with no impact on confidentiality or integrity.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Commerce Cloud \(Accelerator Payment Mock\) | 1808 |
| Sap | Commerce Cloud \(Accelerator Payment Mock\) | 1811 |
| Sap | Commerce Cloud \(Accelerator Payment Mock\) | 1905 |
| Sap | Commerce Cloud \(Accelerator Payment Mock\) | 2005 |
References
- https://launchpad.support.sap.com/#/notes/2975170Permissions Required
- https://launchpad.support.sap.com/#/notes/2975170Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-26810?
How severe is CVE-2020-26810?
How do I fix CVE-2020-26810?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-26805In Sentrifugo 3.2, admin can edit employee's informations vi…7.2
- CVE-2020-26806admin/file.do in ObjectPlanet Opinio before 7.15 allows Unre…8.8
- CVE-2020-26807SAP ERP Client for E-Bilanz, version - 1.0, installation set…3.3
- CVE-2020-26808SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1…7.2
- CVE-2020-26809SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an…5.3
- CVE-2020-2681Vulnerability in the Oracle VM VirtualBox product of Oracle …6.5
- CVE-2020-26811SAP Commerce Cloud (Accelerator Payment Mock), versions - 18…5.3
- CVE-2020-26814SAP Process Integration (PGP Module - Business-to-Business A…4.9
- CVE-2020-26815SAP Fiori Launchpad (News tile Application), versions - 750,…8.6
- CVE-2020-26816SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.…4.5
- CVE-2020-26817SAP 3D Visual Enterprise Viewer, version - 9, allows an user…7.8
- CVE-2020-26818SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750…8.8
Are you affected by CVE-2020-26810?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST