Remote Code Execution Vulnerability in SAP Solution Manager
CVE-2022-22544

9.1CRITICAL

Key Information:

Vendor
SAP
Status
SAP Solution Manager (diagnostics Root Cause Analysis Tools)
Vendor
CVE Published:
9 February 2022

Summary

A security vulnerability in SAP Solution Manager, specifically in the Diagnostics Root Cause Analysis Tools, permits an administrator to execute arbitrary code on all connected Diagnostics Agents. This lack of proper segregation of duties allows an attacker to manipulate managed systems, potentially leading to sensitive information disclosure, loss of system integrity, and denial of service. Organizations using version 720 of this product should assess their security practices to mitigate risks associated with this vulnerability.

Affected Version(s)

SAP Solution Manager (Diagnostics Root Cause Analysis Tools) 720

References

https://launchpad.support.sap.com/#/notes/3140940
x_refsource_MISC
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.