PT-2022-6135 · Microsoft+1 · Windows+1

Published 2022-12-12 · Updated 2023-07-10 · CVE-2022-41261

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Solution Manager (Diagnostic Agent) version 7.20

Description The issue allows an authenticated attacker on a Windows system to access a file containing sensitive data, which can be used to access a configuration file containing credentials to access other system files. Successful exploitation can grant the attacker access to files and systems for which they are not authorized. The vulnerability is related to insufficient access control in the Diagnostic Agent tool of the SAP Solution Manager platform.

Recommendations For SAP Solution Manager (Diagnostic Agent) version 7.20, consider restricting access to sensitive files and configuration files as a temporary workaround until a patch is available. Additionally, review and enforce strict access controls to prevent unauthorized access to system files and credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-00151

CVE-2022-41261

Affected Products

Sap Solution Manager

Windows

References · 7

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3265173 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41261 · Security Note
• https://bdu.fstec.ru/vul/2023-00151 · Security Note
• https://t.me/cvenotify/39960 · Telegram Post
• https://t.me/cibsecurity/54363 · Telegram Post