CVE-2020-26837 Path traversal in SAP Solution Manager (User Experience Monitoring)

High 8.5 Published 9 Dec 2020 Updated 4 Aug 2024

Authenticated attackers can exploit path traversal in SAP Solution Manager to read files, modify configurations, and disrupt services.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-26837?

CVE-2020-26837 is a high-severity path traversal vulnerability in SAP Solution Manager (User Experience Monitoring), published on 9 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exploit an existing path traversal vulnerability to compromise confidentiality exposing elements of the file system, partially compromise integrity allowing the modification of some configurations and partially compromise availability by making certain services unavailable.

Weakness: CWE-22

Which versions are affected by CVE-2020-26837?

It affects 1 product.

Products include Sap Solution Manager.

How do I fix CVE-2020-26837?

No fix has been published for CVE-2020-26837 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-26837 being exploited?

There is no known exploitation of CVE-2020-26837 in the wild and no public exploit code.

Sources

Also known as GHSA-fx65-x2vv-6c9m.