Vulnerability · Published Nov 10, 2020 · Assigned by sap
CVE-2020-26814
Medium 4.9
In plain English
A medium-severity security flaw in SAP Process Integration (PGP - Module Business-to-Business Add On) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.0)4.9Medium
Exploit odds (30 days)0.9%top 39.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Module of Business-to-Business Add-On, these keys can then be used to read messages processed by the module leading to Information Disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Process Integration (PGP - Module Business-to-Business Add On) | < 1.0 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2952084 x_refsource_MISC