CVE-2020-6207

Опубликовано: 10 мар. 2020

Источник: nvd

CVSS3: 10

CVSS3: 9.8

CVSS2: 10

EPSS Критический

Описание

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

Ссылки

http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-Missing-Authorization.html
Third Party Advisory
http://seclists.org/fulldisclosure/2021/Apr/4
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jun/34
Mailing List
Third Party Advisory
https://launchpad.support.sap.com/#/notes/2890213
Permissions Required
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
Broken Link
Vendor Advisory
http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-Missing-Authorization.html
Third Party Advisory
http://seclists.org/fulldisclosure/2021/Apr/4
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jun/34
Mailing List
Third Party Advisory
https://launchpad.support.sap.com/#/notes/2890213
Permissions Required
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
Broken Link
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6207
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sap:solution_manager:7.20:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.94152

Критический

10 Critical

CVSS3

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-306

Связанные уязвимости

GHSA-r9hh-cq9h-xf68

CVSS3: 9.8

github

больше 3 лет назад

BDU:2021-02133

CVSS3: 10

fstec

почти 6 лет назад

Уязвимость компонента User Experience Monitoring платформы управления программными средами SAP Solution Manager, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 100%

0.94152

Критический

10 Critical

CVSS3

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-306