PT-2020-19142 · Sap · Sap Focused Run+1

Yvan Genuer · Published 2020-10-20 · Updated 2022-08-22 · CVE-2020-6369

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Solution Manager and SAP Focused Run versions 9.7, 10.1, 10.5, 10.7

Description The issue allows an unauthenticated attacker to bypass authentication if the default passwords for Admin and Guest have not been changed by the administrator. This may impact the confidentiality of the service.

Recommendations For versions 9.7, 10.1, 10.5, 10.7, update to the version provided in WILY INTRO ENTERPRISE to resolve the issue. As a temporary workaround, consider changing the default passwords for Admin and Guest to prevent unauthorized access.

Fix

Related Identifiers

CVE-2020-6369

Affected Products

Sap Focused Run

Sap Solution Manager

References · 11

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6369 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2971638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6369 · Security Note
• https://t.me/defcon_news/103259 · Telegram Post
• http://seclists.org/fulldisclosure/2021/Jun/31 · Note
• http://packetstormsecurity.com/files/163159/SAP-Wily-Introscope-Enterprise-Default-Hard-Coded-Credentials.html · Note
• https://t.me/cvenotify/16292 · Telegram Post
• https://t.me/secharvester/12779 · Telegram Post
• https://t.me/rnetsec/17251 · Telegram Post
• https://t.me/cvenotify/16391 · Telegram Post