CVE-2020-26832: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2020-26832 is a missing authorization vulnerability affecting SAP AS ABAP (SAP Landscape Transformation) versions 2011_1_620 through 2020, and SAP S4 HANA (SAP Landscape Transformation) versions 101 through 105. The vulnerability was discovered in October 2020 and publicly disclosed in December 2020 (SAP Security).

The vulnerability stems from a missing authorization check in the function module CNV_GET_USERS_FOR_APP_SERVER of function group CNV_00001_HELP. This allows a high privileged user to execute a RFC function module to which access should be restricted. The vulnerability has a CVSS v3.1 base score of 7.6 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H (NVD).

Successful exploitation of this vulnerability allows an attacker to gain access to sensitive internal information of the vulnerable SAP system and potentially make the SAP systems completely unavailable to intended users through denial of service attacks (SEC Consult).

The vulnerability can be exploited by a high-privileged user who can invoke the function remotely via the RFC protocol. The function does not perform any explicit authorization check and depending on specific import parameters, can leak active logon sessions or terminate all active logon sessions through kernel calls (SEC Consult).

SAP has released a patch for this vulnerability in SAP Security Note 2993132. Organizations are advised to implement this security note as a priority to protect their business-critical data (SecurityWeek).