{"api_version":"1","generated_at":"2026-07-23T14:33:26+00:00","cve":"CVE-2020-26824","urls":{"html":"https://cve.report/CVE-2020-26824","api":"https://cve.report/api/cve/CVE-2020-26824.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-26824","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-26824"},"summary":{"title":"CVE-2020-26824","description":"SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports Service, this has an impact to the integrity and availability of the service.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2020-11-10 17:15:00","updated_at":"2021-07-21 11:39:00"},"problem_types":["CWE-306"],"metrics":[],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2985866","name":"https://launchpad.support.sap.com/#/notes/2985866","refsource":"MISC","tags":["Permissions Required","Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571","refsource":"MISC","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – November 2020 - Product Security Response at SAP - Community Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26824","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26824","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"26824","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"solution_manager","cpe6":"7.20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"26824","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"solution_manager","cpe6":"7.20","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-26824","ASSIGNER":"cna@sap.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"SAP SE","product":{"product_data":[{"product_name":"SAP Solution Manager (JAVA stack)","version":{"version_data":[{"version_name":"<","version_value":"7.20"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports Service, this has an impact to the integrity and availability of the service."}]},"impact":{"cvss":{"baseScore":"10","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Missing Authorization"}]}]},"references":{"reference_data":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571","refsource":"MISC","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"},{"url":"https://launchpad.support.sap.com/#/notes/2985866","refsource":"MISC","name":"https://launchpad.support.sap.com/#/notes/2985866"}]}},"nvd":{"publishedDate":"2020-11-10 17:15:00","lastModifiedDate":"2021-07-21 11:39:00","problem_types":["CWE-306"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.8},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.4},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:solution_manager:7.20:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"26824","Ordinal":"188258","Title":"CVE-2020-26824","CVE":"CVE-2020-26824","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"26824","Ordinal":"1","NoteData":"SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports Service, this has an impact to the integrity and availability of the service.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"26824","Ordinal":"2","NoteData":"2020-11-10","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"26824","Ordinal":"3","NoteData":"2020-11-10","Type":"Other","Title":"Modified"}]}}}