Vulnerability · Published Nov 10, 2020 · Assigned by sap
CVE-2020-26810
High 7.5
In plain English
A high-severity security flaw in SAP Commerce Cloud (Accelerator Payment Mock) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.0)7.5High
Exploit odds (30 days)1.1%top 33.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerce service itself unavailable leading to Denial of Service with no impact on confidentiality or integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Commerce Cloud (Accelerator Payment Mock) | < 1808< 1811< 1905< 2005 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2975170 x_refsource_MISC