Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2020-26816 | First vendor Publication | 2020-12-09 |
| Vendor | Cve | Last vendor Modification | 2021-07-21 |
Security-Database Scoring CVSS v3
| Cvss vector : CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | |||
|---|---|---|---|
| Overall CVSS Score | 4.5 | ||
| Base Score | 4.5 | Environmental Score | 4.5 |
| impact SubScore | 3.6 | Temporal Score | 4.5 |
| Exploitabality Sub Score | 0.9 | ||
| Attack Vector | Adjacent | Attack Complexity | Low |
| Privileges Required | High | User Interaction | None |
| Scope | Unchanged | Confidentiality Impact | High |
| Integrity Impact | None | Availability Impact | None |
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:L/Au:S/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 2.7 | Attack Range | Adjacent network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 5.1 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service stored in the database in the DER encoded format and is not encrypted. This enables an attacker who has administrator access to the SAP NetWeaver AS Java to decode the keys because of missing encryption and get some application data and client credentials of adjacent systems. This highly impacts Confidentiality as information disclosed could contain client credentials of adjacent systems. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26816 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-312 | Cleartext Storage of Sensitive Information |
CPE : Common Platform Enumeration
Sources (Detail)
| Source | Url |
|---|---|
| MISC | https://launchpad.support.sap.com/#/notes/2971163 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 |
Alert History
| Date | Informations |
|---|---|
| 2021-08-05 01:38:22 |
|
| 2021-07-21 17:23:10 |
|
| 2021-05-04 13:50:49 |
|
| 2021-04-22 03:02:15 |
|
| 2020-12-11 00:22:48 |
|
| 2020-12-09 21:24:06 |
|
