PT-2020-16514 · Sap · Sap Solution Manager

Gonzalo Roisman + 1 · Published 2020-12-09 · Updated 2021-06-17 · CVE-2020-26830

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP Solution Manager 7.2 (User Experience Monitoring) version 7.2

Description The issue arises from inadequate access control, allowing a network attacker authenticated as a regular user to perform operations restricted to administrators. This includes changing the User Experience Monitoring configuration, obtaining details about configured SAP Solution Manager agents, and deploying a malicious User Experience Monitoring script.

Recommendations For SAP Solution Manager 7.2 (User Experience Monitoring) version 7.2, consider restricting access to the User Experience Monitoring configuration and agent details to minimize the risk of exploitation. As a temporary workaround, limit the use of operations that can be used to deploy scripts until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-26830

Affected Products

Sap Solution Manager

References · 10

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2983204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26830 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26830 · Vendor Advisory
• https://t.me/cvenotify/6855 · Telegram Post
• http://packetstormsecurity.com/files/163161/SAP-Solution-Manager-7.2-Missing-Authorization.html · Note
• https://t.me/cvenotify/16298 · Telegram Post
• http://seclists.org/fulldisclosure/2021/Jun/29 · Note
• https://t.me/cvenotify/6994 · Telegram Post
• https://t.me/cvenotify/6854 · Telegram Post