CVE-2020-26809

EUVD-2020-19345
SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
sapCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.html
http://seclists.org/fulldisclosure/2021/Jun/27
https://launchpad.support.sap.com/#/notes/2975189
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.html
http://seclists.org/fulldisclosure/2021/Jun/27
https://launchpad.support.sap.com/#/notes/2975189
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571