SB20200310147 - Multiple vulnerabilities in SAP Solution Manager

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authentication (CVE-ID: CVE-2020-6198)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authentication in Diagnostics Agent component. A remote non-authenticated attacker can control all remote functions on the Agent.

2) Missing Authentication for Critical Function (CVE-ID: CVE-2020-6207)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to absent authentication checks within the User Experience Monitoring component. A remote non-authenticated attacker can compromise all SMDAgents connected to the Solution Manager.

Remediation

Install update from vendor's website.

References

• https://launchpad.support.sap.com/#/notes/2845377
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
• https://launchpad.support.sap.com/#/notes/2890213