Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Multiple CVE IDs Missing Authentication Check in SAP Solution Manager (JAVA stack), SAP security note 2985866

Description

Some Authentication checks are missing in SAP Solution Manager (software component LM-SERVICE). An un-authenticated attacker is able to compromise the system. This has an impact to the integrity as well as availability of the service. The affected services are:

Available fix and Supported packages

  • LM-SERVICE | 7.20 | 7.20
  • SOLMANDIAG 720 | SP004 | 000012
  • SOLMANDIAG 720 | SP005 | 000013
  • SOLMANDIAG 720 | SP006 | 000014
  • SOLMANDIAG 720 | SP007 | 000020
  • SOLMANDIAG 720 | SP008 | 000016
  • SOLMANDIAG 720 | SP009 | 000008
  • SOLMANDIAG 720 | SP010 | 000002
  • SOLMANDIAG 720 | SP011 | 000004

Affected component

    SV-SMG-MON-EEM
    End User Experience Monitoring

CVSS

Score: 10.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2985866

TAGS

#LM-SERVICE
#SAP-Solution-Manager-7.2
#&160-CVE-2020-26821
#&160-CVE-2020-26822
#&160-CVE-2020-26823
#&160-CVE-2020-26824

More to explorer

SAP Cloud Connector Certificate Validation Issue

Date of Release: February 13, 2024 Advisory ID: CVE-2024-25642 Affected Software: SAP Cloud Connector Versions Affected: 2.15.0 to 2.16.1 Vulnerability Summary:A critical vulnerability,