SAP Note 2906994
High priority
High priority
SAP security note 2906994, “[CVE-2020-6235] Missing authentication check in SAP Solution Manager (Diagnostics Agent )”, is a program error note released on April 14, 2020. Below are the symptom, SAP recommended solution and references.
Description
Symptom
The Diagnostics Agent does not perform the authentication check for the functionalities of the Collector Simulator.
Impact:
- Unauthorized access to sensitive information.
- Ability to access administrative or other privileged functionalities.
Solution
- Enable Maintenance Mode: Use the SAP Solution Manager Agent Administration UI to enable Maintenance Mode.
- Deploy the LM-SERVICE Software Component: Ensure the LM-SERVICE component is deployed as mentioned in the solution section of SAP Note 1595736.
- Apply Necessary Support Package Patches: Refer to the Support Package Patches section below to apply the relevant patches.
- User Permissions: Ensure that users who need to utilize this functionality are either administrators for the Solution Manager AS JAVA or members of the SAP_SMWORK_TECH_MON group.
CVSS
Score 8.6 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
Full note on SAP: SAP Support Launchpad note 2906994
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
