Login Request a demo
Low severity · published Jun 12, 2019
CVE-2019-0307
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file…
2.4
CVSS
2.1%
EPSS
No
On KEV
Description
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Solution Manager · Sap
7.2 · source: NVD
Affected product
SM
Solution Manager
Sap
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0307
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0307
Permissions Required
https://launchpad.support.sap.com/#/notes/2772266
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242
More from Solution Manager
9.8
CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
10.0
CVE-2020-26824
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports…
10.0
CVE-2020-26823
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics…
10.0
CVE-2020-26822
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Outside Discovery…
10.0
CVE-2020-26821
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the SVG Converter…