by Kastro
Paper/Archive/CVE-2020-6198

CVE-2020-6198

SAP SE SAP Solution Manager (Diagnostics Agent) — SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.2.722 × 2014.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remote functions on the Agent due to Missing Authentication Check.

Affected

ProductAffectedFixed inSource
SAP Solution Manager (Diagnostics Agent)< 7.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
sap (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305reflaunchpad.support.sap.com/#/notes/2845377