CVE-2020-26828

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-09 · updated 2026-06-17
Weakness: CWE-434

Description

SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. In some file types it is possible to enter formulas which can call external applications or execute scripts. The execution of a payload (script) on target machine could be used to steal and modify the data available in the spreadsheet

Affected products

SAP SE SAP Disclosure Management: 10.1

References

https://launchpad.support.sap.com/#/notes/2971180
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079
https://launchpad.support.sap.com/#/notes/2971180
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079

Get alerted when CVE-2020-26828 or the next vulnerability affects your stack