CVE-2022-22544

CRITICAL

SAP Solution Manager 720 - Authenticated Remote Code Execution and File Access via Diagnostics Root Cause Analysis Tools

Title source: llm
STIX 2.1

Description

Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse files on their systems. An attacker could thereby control the managed systems. It is considered that this is a missing segregation of duty for the SAP Solution Manager administrator. Impacts of unauthorized execution of commands can lead to sensitive information disclosure, loss of system integrity and denial of service.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/3140940

Scores

CVSS v3 9.1
EPSS 0.0043
EPSS Percentile 62.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Details

Status published
Products (1)
sap/solution_manager 7.20
Published Feb 09, 2022
Tracked Since Feb 18, 2026