Actively exploited in the wild
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
SAP - Solution Manager · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-6207
CriticalCVSS 9.8KEVSummary
SAP Solution Manager (User Experience Monitoring), version 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
Risk Assessment
An attacker can gain full access to all SMDAgents, leading to compromise of the entire monitoring environment.
Recommendation
Apply SAP patches for version 7.2 or upgrade to a newer version to fix the missing authentication.
Other vulnerabilities in SAP Solution Manager
See all- CVE-2014-5175High
The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.
- CVE-2013-7363High
An unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify application configurations, and install or remove applications via vectors involving the P4 protocol.
Original NVD description (English source)
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.