Critical severity · published Mar 10, 2020
CVE-2020-6198
SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remote functions on the Agent due to Missing Authentication Check.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Solution Manager · Sap
7.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6198
Permissions Required
https://launchpad.support.sap.com/#/notes/2845377
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
More from Solution Manager
9.8
CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
10.0
CVE-2020-26824
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports…
10.0
CVE-2020-26823
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics…
10.0
CVE-2020-26822
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Outside Discovery…
10.0
CVE-2020-26821
SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the SVG Converter…