Vulnerability · Published Nov 10, 2020 · Assigned by sap

CVE-2020-26815

High 8.6

In plain English

A high-severity security flaw in SAP Fiori Launchpad (News Tile Application) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.0)8.6High

Exploit odds (30 days)1.4%top 27.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP Fiori Launchpad (News Tile Application)	< 750< 751< 752< 753< 754< 755

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2984627 x_refsource_MISC