Vulnerability · Published Nov 10, 2020 · Assigned by sap
CVE-2020-26809
Medium 5.3
In plain English
A medium-severity security flaw in SAP Commerce Cloud from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.0)5.3Medium
Exploit odds (30 days)2.1%top 18.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Commerce Cloud | < 1808< 1811< 1905< 2005 |
References
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/2975189 x_refsource_MISC
- 20210614 Onapsis Security Advisory 2021-0007: Exposure of Sensitive Information to an Unauthorized Actor mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.html x_refsource_MISC