Vulnerability · Published Dec 9, 2020 · Assigned by sap

CVE-2020-26836

Low 3.4

In plain English

A low-severity security flaw in SAP Solution Manager (Trace Analysis) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.0)3.4Low

Exploit odds (30 days)2.2%top 17.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP Solution Manager (Trace Analysis)	< 720

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2938650 x_refsource_MISC
20210614 Onapsis Security Advisory 2021-0005: SAP Solution Manager Open Redirect from Trace Analysis mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/163136/SAP-Solution-Manager-7.2-ST-720-Open-Redirection.html x_refsource_MISC