SM
Product
Solution Manager
On CISA KEVExploited in the wild
33
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 8High 8Medium 14Low 1
Watch
Add Solution Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-6207 In wildKEV | 9.8 | Mar 10 | SAP Solution Manager Missing Authentication for Critical Function Vulnerability Affected: 7.20 |
| CVE-2020-26824 | 10.0 | Nov 10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Legacy Ports… Affected: 7.20 |
| CVE-2020-26823 | 10.0 | Nov 10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics… Affected: 7.20 |
| CVE-2020-26822 | 10.0 | Nov 10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Outside Discovery… Affected: 7.20 |
| CVE-2020-26821 | 10.0 | Nov 10 | SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the SVG Converter… Affected: 7.20 |
| CVE-2020-6198 | 9.8 | Mar 10 | SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources Affected: 7.20 |
| CVE-2022-22544 | 9.1 | Feb 9 | Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse files on their… Affected: 7.20 |
| CVE-2020-26837 | 9.1 | Dec 9 | SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exploit an existing path traversal… Affected: 7.20 |
| CVE-2023-27893 | 8.8 | Mar 14 | An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions… Affected: 740 |
| CVE-2018-2361 | 8.8 | Jan 9 | In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for configuring the BPO tools Affected: 7.20 |
| CVE-2020-6235 | 8.6 | Apr 14 | SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Simulator, leading to Missing… Affected: 7.2 |
| CVE-2020-6271 | 8.2 | Jun 10 | SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the… Affected: 7.2 |
| CVE-2020-26830 | 8.1 | Dec 9 | SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user Affected: 7.20 |
| CVE-2016-10005 | 7.5 | Dec 19 | Webdynpro in SAP Solman 7.1 through 7.31 allows remote attackers to obtain sensitive information via webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd requests, aka SAP… Affected: 7.1; 7.1; 7.1; 7.1; 7.1; 7.20; +3 more |
| CVE-2023-36925 | 7.2 | Jul 11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests Affected: 7.20 |
| CVE-2023-36921 | 7.2 | Jul 11 | SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request Affected: 7.20 |
| CVE-2023-49587 | 6.4 | Dec 12 | SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without… Affected: 720 |
| CVE-2023-23852 | 6.1 | Feb 14 | SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability Affected: 720 |
| CVE-2022-41275 | 6.1 | Dec 13 | In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can be redirected to a… Affected: 740; 750 |
| CVE-2020-26836 | 6.1 | Dec 9 | SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link… Affected: 7.20 |
| CVE-2020-6369 | 5.9 | Oct 20 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the authentication if the… Affected: 9.7; 10.1; 10.5; 10.7 |
| CVE-2022-41261 | 5.5 | Dec 12 | SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can be used to access a… Affected: 7.20 |
| CVE-2019-0291 | 5.5 | May 14 | Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted Affected: 7.2 |
| CVE-2023-23855 | 5.4 | Feb 14 | SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation Affected: 720 |
| CVE-2023-0025 | 5.4 | Feb 14 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read… Affected: 720 |
| CVE-2023-0024 | 5.4 | Feb 14 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read… Affected: 720 |
| CVE-2018-2405 | 5.4 | Apr 10 | SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site… Affected: 7.10; 7.20 |
| CVE-2020-6261 | 5.3 | Jul 1 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation Affected: 7.20 |
| CVE-2020-6260 | 5.3 | Jun 10 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation Affected: 7.20 |
| CVE-2021-21483 | 4.9 | Apr 13 | Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct serious impact beyond the… Affected: 7.20 |
| CVE-2019-0307 | 2.4 | Jun 12 | Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file… Affected: 7.2 |
| CVE-2014-5175 | – | Jul 31 | The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and… Affected: 7.1 |
| CVE-2013-7363 | – | Apr 10 | Unspecified vulnerability in the Diagnostics (SMD) agent in SAP Solution Manager allows remote attackers to obtain sensitive information, modify the configuration of applications,… Affected: All versions, or not specified |
Showing 33