Medium severity · published Oct 20, 2020
CVE-2020-6369
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the authentication if the…
5.9
CVSS
2.7%
EPSS
No
On KEV
Description
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the authentication if the default passwords for Admin and Guest have not been changed by the administrator.This may impact the confidentiality of the service.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Focused Run · Sap
9.7; 10.1; 10.5; 10.7 · source: NVD
SM
Solution Manager · Sap
9.7; 10.1; 10.5; 10.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-6369
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-6369
Third Party Advisory
http://packetstormsecurity.com/files/163159/SAP-Wily-Introscope-Enterprise-Default-Hard-Coded-Credentials.html
Mailing List
http://seclists.org/fulldisclosure/2021/Jun/31
Permissions Required
https://launchpad.support.sap.com/#/notes/2971638
Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196
More from Focused Run
6.5
CVE-2021-27609
SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and manipulate the…
6.1
CVE-2022-24399
The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-data, resulting in…
2.7
CVE-2022-27657
A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP…