CVE-2020-26818: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2020-26818 affects SAP NetWeaver AS ABAP (Web Dynpro) versions 731, 740, 750, 751, 752, 753, 754, 755, and 782. The vulnerability was disclosed on November 10, 2020, and allows authenticated users to access Web Dynpro components that reveal sensitive system information typically restricted to highly privileged users (NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability stems from missing authorization checks in Web Dynpro components. The weakness is categorized as CWE-862 (Missing Authorization) (NVD).

The vulnerability can lead to unauthorized access to sensitive system information, potentially compromising the confidentiality, integrity, and availability of the affected systems. The high CVSS score indicates significant potential impact on the system's security (NVD).

The vulnerability requires network access and low-level privileges to exploit, with no user interaction needed. The attack complexity is rated as low, making it relatively straightforward to exploit for authenticated users (NVD).

SAP has released security patches to address this vulnerability. Organizations running affected versions of SAP NetWeaver AS ABAP should apply the available updates through SAP Security Note 2971954 (SAP Note).