CVE-2020-26811

SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Request Forgery attack which could lead to retrieval of limited pieces of information about the service with no impact on integrity or availability.

• CWE-918

• http://packetstormsecurity.com/files/163143/SAP-Hybris-eCommerce-Server-Side-Request-Forgery.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Jun/26Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2975170Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory
• http://packetstormsecurity.com/files/163143/SAP-Hybris-eCommerce-Server-Side-Request-Forgery.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Jun/26Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2975170Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory

Published

Nov 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26806admin/file.do in ObjectPlanet Opinio before 7.15 allows Unre…8.8
• CVE-2020-26807SAP ERP Client for E-Bilanz, version - 1.0, installation set…3.3
• CVE-2020-26808SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1…7.2
• CVE-2020-26809SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an…5.3
• CVE-2020-2681Vulnerability in the Oracle VM VirtualBox product of Oracle …6.5
• CVE-2020-26810SAP Commerce Cloud (Accelerator Payment Mock), versions - 18…7.5
• CVE-2020-26814SAP Process Integration (PGP Module - Business-to-Business A…4.9
• CVE-2020-26815SAP Fiori Launchpad (News tile Application), versions - 750,…8.6
• CVE-2020-26816SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.…4.5
• CVE-2020-26817SAP 3D Visual Enterprise Viewer, version - 9, allows an user…7.8
• CVE-2020-26818SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750…8.8
• CVE-2020-26819SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750…8.8