Insecure Storage of Credentials in SAP Solution Manager by SAP
CVE-2019-0307

2.4LOW

Key Information:

Vendor
SAP
Status
SAP Solution Manager(diagnostics Agent)
Vendor
CVE Published:
12 June 2019

Summary

The Diagnostics Agent in SAP Solution Manager version 7.2 is compromised by its management of credential storage. It saves critical credentials such as SLD user connection and Solman user communication within the SAP Secure Storage file without encryption by default. This lack of encryption allows an attacker with administrative privileges to decode these credentials, potentially granting access to the entire configuration of the system. However, it is important to note that no sensitive system information can be accessed through this vulnerability.

Affected Version(s)

SAP Solution Manager(Diagnostics Agent) < 7.2

References

https://launchpad.support.sap.com/#/notes/2772266
x_refsource_MISC
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageI...
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
2.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.