High severity7.2NVD Advisory· Published Nov 10, 2020· Updated Jun 17, 2026
CVE-2020-26808
CVE-2020-26808
Description
SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_620:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_620:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_640:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_700:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_710:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_730:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_731:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_as_abap\(dmis\):2011_1_752:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_as_abap\(dmis\):2020:*:*:*:*:*:*:*
cpe:2.3:a:sap:sap_s4_hana\(dmis\):101:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:sap:sap_s4_hana\(dmis\):101:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_s4_hana\(dmis\):102:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_s4_hana\(dmis\):103:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_s4_hana\(dmis\):104:*:*:*:*:*:*:*
- cpe:2.3:a:sap:sap_s4_hana\(dmis\):105:*:*:*:*:*:*:*
- SAP SE/SAP AS ABAP(DMIS)v5Range: < 2011_1_620
- SAP SE/SAP S4 HANA(DMIS)v5Range: < 101
Patches
Vulnerability mechanics
References
4- packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.htmlnvdExploitThird Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2022/May/42nvdExploitMailing ListThird Party Advisory
- wiki.scn.sap.com/wiki/pages/viewpage.actionnvdVendor Advisory
- launchpad.support.sap.comnvdPermissions Required
News mentions
0No linked articles in our index yet.