Insecure Storage of Credentials in SAP Solution Manager by SAP

CVE-2019-0307

What is CVE-2019-0307?

The Diagnostics Agent in SAP Solution Manager version 7.2 is compromised by its management of credential storage. It saves critical credentials such as SLD user connection and Solman user communication within the SAP Secure Storage file without encryption by default. This lack of encryption allows an attacker with administrative privileges to decode these credentials, potentially granting access to the entire configuration of the system. However, it is important to note that no sensitive system information can be accessed through this vulnerability.

References