CVE-2023-0025
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
SAP Solution Manager (BSP Application) version 720 allows an authenticated attacker to craft a malicious link that, when clicked by an unsuspecting user, can be used to read or modify sensitive information or craft a payload that may restrict access to resources.
Risk Assessment
An attacker could abuse user trust in the application to steal or modify data. This may compromise confidentiality and integrity of information.
Recommendation
Apply the SAP fix for SAP Solution Manager version 720. Additionally, educate users on recognizing suspicious links.
Other vulnerabilities in SAP Solution Manager
See all- CVE-2014-5175High
The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.
- CVE-2013-7363High
An unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify application configurations, and install or remove applications via vectors involving the P4 protocol.
- CVE-2020-6207CriticalActively exploited
SAP Solution Manager (User Experience Monitoring), version 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
Original NVD description (English source)
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS