PT-2022-2173 · Sap · Sap Solution Manager

Published 2022-02-08 · Updated 2022-10-25 · CVE-2022-22544

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Solution Manager version 720

Description The issue is related to insufficient access control in the SAP Solution Manager Diagnostics (Root Cause Analysis) tool, allowing a remote attacker to elevate their privileges. This can enable an administrator to execute code on all connected Diagnostics Agents and browse files on their systems, potentially leading to control of the managed systems. The impact of unauthorized command execution can result in sensitive information disclosure, loss of system integrity, and denial of service.

Recommendations For SAP Solution Manager version 720, consider restricting the privileges of the administrator role to minimize the risk of exploitation, and ensure proper segregation of duties to prevent unauthorized access to managed systems.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2022-02184

CVE-2022-22544

Affected Products

Sap Solution Manager

References · 10

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02184 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22544 · Security Note
• https://launchpad.support.sap.com/#/notes/3140940 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22544 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/display/SM/Solution+Manager+Diagnostics · Note
• https://t.me/cibsecurity/37149 · Telegram Post
• https://vuldb.com/ru/?id.192660 · Note
• https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+February+2022 · Note
• https://accounts.sap.com/saml2/idp/sso · Note