Vulnerability Details CVE-2020-26809
SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 49.5%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 5.0
References
- http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2021/Jun/27
- https://launchpad.support.sap.com/#/notes/2975189
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
- http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2021/Jun/27
- https://launchpad.support.sap.com/#/notes/2975189
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
Products affected by CVE-2020-26809
-
cpe:2.3:a:sap:commerce_cloud:1808
-
cpe:2.3:a:sap:commerce_cloud:1811
-
cpe:2.3:a:sap:commerce_cloud:1905
-
cpe:2.3:a:sap:commerce_cloud:2005