#VU48818 Improper Authentication in SAP NetWeaver - CVE-2020-26829
Published: December 8, 2020
Vulnerability identifier: #VU48818
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2020-26829
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
SAP NetWeaver
SAP NetWeaver
Software vendor:
SAP
SAP
Description
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests within the P2P Cluster Communication component. A remote attacker can bypass authentication process and gain unauthorized access to the application.
Successful exploitation of the vulnerability may allow an attacker to compromise the server.
Remediation
Install updates from vendor's website.