Improper Authentication in SAP NetWeaver - CVE-2020-26829
Published: December 8, 2020
Vulnerability identifier: #VU48818
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-26829
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests within the P2P Cluster Communication component. A remote attacker can bypass authentication process and gain unauthorized access to the application.
Successful exploitation of the vulnerability may allow an attacker to compromise the server.
Affected software
SAP NetWeaver
How to mitigate CVE-2020-26829
Install updates from vendor's website.