Authentication Flaw in Simple Diagnostics Agent by SAP
CVE-2022-24396

7.8HIGH

Key Information:

Vendor

SAP
Status
SAP Focused Run (simple Diagnostics Agent)
Vendor
CVE Published:
10 March 2022

What is CVE-2022-24396?

The Simple Diagnostics Agent, from SAP, lacks necessary authentication checks for functionalities accessible via localhost on HTTP port 3005. This vulnerability enables unauthorized users to interact with administrative and privileged functions, potentially leading to the exposure, modification, or deletion of sensitive information and configurations. Remediation is essential to secure these capabilities and protect sensitive data from unauthorized access.

Affected Version(s)

SAP Focused Run (Simple Diagnostics Agent) < >= 1.0 < 1.0

SAP Focused Run (Simple Diagnostics Agent) < 1.58 < 1.58

References

https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
x_refsource_MISC
https://launchpad.support.sap.com/#/notes/3145987
x_refsource_MISC
http://seclists.org/fulldisclosure/2022/Jun/38
mailing-listx_refsource_FULLDISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.