7.6
CVSS 3.0
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
Описание
Оригинално описание
SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. These operations can be used to Change the User Experience Monitoring configuration, obtain details about the configured SAP Solution Manager agents, Deploy a malicious User Experience Monitoring script.
Засегнати продукти
- SAP SE SAP Solution Manager (User Experience Monitoring): < 7.20
История
- 9 декември 2020 Публикувано
Други уязвимости в SAP SE SAP Solution Manager (User Experience Monitoring)
- 8.5CVE-2020-26837
- 10.0CVE-2020-6207
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2020-26830
- https://nvd.nist.gov/vuln/detail/CVE-2020-26830
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079
- https://launchpad.support.sap.com/#/notes/2983204
- http://seclists.org/fulldisclosure/2021/Jun/29
- http://packetstormsecurity.com/files/163161/SAP-Solution-Manager-7.2-Missing-Authorization.html