CVE-2020-26816
Last modified
CVE-2020-26816 is a medium-severity vulnerability rated 4.5/10 on the CVSS scale. SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service stored in the database in the DER encoded format and is not encrypted. This enables an attacker who has administrator access to the SAP NetWeaver AS Java to decode the keys because of missing encryption and get some application data and client credentials of adjacent systems. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service stored in the database in the DER encoded format and is not encrypted. This enables an attacker who has administrator access to the SAP NetWeaver AS Java to decode the keys because of missing encryption and get some application data and client credentials of adjacent systems. This highly impacts Confidentiality as information disclosed could contain client credentials of adjacent systems.
Metrics
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Netweaver Application Server Java | 7.10 |
| Sap | Netweaver Application Server Java | 7.11 |
| Sap | Netweaver Application Server Java | 7.20 |
| Sap | Netweaver Application Server Java | 7.30 |
| Sap | Netweaver Application Server Java | 7.31 |
| Sap | Netweaver Application Server Java | 7.40 |
| Sap | Netweaver Application Server Java | 7.50 |
References
- https://launchpad.support.sap.com/#/notes/2971163Permissions Required
- https://launchpad.support.sap.com/#/notes/2971163Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-26816?
How severe is CVE-2020-26816?
How do I fix CVE-2020-26816?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-26809SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an…5.3
- CVE-2020-2681Vulnerability in the Oracle VM VirtualBox product of Oracle …6.5
- CVE-2020-26810SAP Commerce Cloud (Accelerator Payment Mock), versions - 18…7.5
- CVE-2020-26811SAP Commerce Cloud (Accelerator Payment Mock), versions - 18…5.3
- CVE-2020-26814SAP Process Integration (PGP Module - Business-to-Business A…4.9
- CVE-2020-26815SAP Fiori Launchpad (News tile Application), versions - 750,…8.6
- CVE-2020-26817SAP 3D Visual Enterprise Viewer, version - 9, allows an user…7.8
- CVE-2020-26818SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750…8.8
- CVE-2020-26819SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750…8.8
- CVE-2020-2682Vulnerability in the Oracle VM VirtualBox product of Oracle …8.2
- CVE-2020-26820SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.…7.2
- CVE-2020-26821SAP Solution Manager (JAVA stack), version - 7.20, allows an…10
Are you affected by CVE-2020-26816?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST