CVE-2023-36921
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
SAP Solution Manager (Diagnostics agent) version 7.20 allows an attacker to tamper with headers in a client request, misleading the SAP Diagnostics Agent into serving poisoned content to the server. Successful exploitation can lead to a limited impact on confidentiality and availability of the application.
Risk Assessment
The organization may experience a limited impact on data confidentiality and application availability, potentially leading to disruptions in system operations.
Recommendation
It is recommended to update SAP Solution Manager to the latest version and to monitor and secure headers in client requests.
Other vulnerabilities in SAP Solution Manager (Diagnostics agent) version 7.20
Original NVD description (English source)
SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS