Vulnerability · Published Dec 9, 2020 · Assigned by sap
CVE-2020-26834
Medium 4.2
In plain English
A medium-severity security flaw in SAP HANA Database from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.0)4.2Medium
Exploit odds (30 days)0.7%top 47.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. It is possible to manipulate a valid existing SAML bearer token to authenticate as a user whose name is identical to the truncated username for whom the SAML bearer token was issued.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP HANA Database | < 2.0 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2978768 x_refsource_MISC