SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:LSap Solution Manager
APPSap7.20
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2020-6207CRITICAL9.8⚠ KEVPL ✓same product
SAP Solution Manager 7.2 – brak uwierzytelnienia w module UX Monitoring
CVE-2022-22544CRITICAL9.1PL ✓same product
SAP Solution Manager: wykonanie kodu na podłączonych agentach przez administratora
CVE-2020-26837CRITICAL9.1PL ✓same product
SAP Solution Manager 7.2 – path traversal via upload złośliwego skryptu
CVE-2020-26823CRITICAL10.0PL ✓same product
SAP Solution Manager – brak autoryzacji w usłudze Diagnostics Agent (Auth Bypass)
CVE-2020-26821CRITICAL10.0PL ✓same product
SAP Solution Manager – brak autoryzacji w SVG Converter Service (RCE/DoS)