Multiple vulnerabilities in SAP Solution Manager
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2023-36921 CVE-2023-36925 |
| CWE-ID | CWE-644 CWE-918 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SAP Solution Manager Web applications / Remote management & hosting panels |
| Vendor | SAP |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Improper Neutralization of HTTP Headers for Scripting Syntax
EUVDB-ID: #VU78731
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-36921
CWE-ID:
CWE-644 - Improper Neutralization of HTTP Headers for Scripting Syntax
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to improper input validation when processing HTTP requests in diagnostic agent. A remote non-authenticated attacker can send a specially crafted HTTP request with an arbitrary header that will be accepted by the application.
Successful exploitation of the vulnerability may allow an attacker to perform cross-site scripting, cache poisoning or session hijacking attacks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSAP Solution Manager: 7.20
CPE2.3 External linkshttp://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10&july2023
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Server-Side Request Forgery (SSRF)
EUVDB-ID: #VU78730
Risk: Medium
CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-36925
CWE-ID:
CWE-918 - Server-Side Request Forgery (SSRF)
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in diagnostics agent. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSAP Solution Manager: 7.20
CPE2.3 External linkshttp://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10&july2023
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
