Unauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent)
CVE-2023-36925

7.2HIGH

Key Information:

Vendor
SAP
Status
SAP Solution Manager (diagnostics Agent)
Vendor
CVE Published:
11 July 2023

Summary

A vulnerability in the SAP Solution Manager's Diagnostics agent version 7.20 allows unauthenticated attackers to execute HTTP requests without authentication. This can lead to unauthorized commands being run against the system, potentially compromising the confidentiality and availability of the affected application and any connected systems that the Diagnostics agent has access to. Organizations using this product should be aware of the risks involved and implement necessary security measures to protect against unauthorized access.

Affected Version(s)

SAP Solution Manager (Diagnostics agent) 7.20

References

https://me.sap.com/notes/3352058
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.