Back to overview

CVE-2020-6207

CRITICAL KEV CISA Exploitation: ACTIVE
10.0
CVSS 3.0
Description
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

Metadata

CVE ID
CVE-2020-6207
State
PUBLISHED
Assigner
sap
Reserved
2020-01-08 00:00 UTC
Published
2020-03-10 20:20 UTC
Last updated
2025-10-21 23:35 UTC
Primary CWE
CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product
SAP SE / SAP Solution Manager (User Experience Monitoring)
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
yes
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
Vendor
SAP
Product
Solution Manager
Added to KEV
2021-11-03
Due date
2022-05-03
Ransomware
Not known
Required action
Apply updates per vendor instructions.
CISA description
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
Affected products (1)
VendorProductPlatformVersions
SAP SE SAP Solution Manager (User Experience Monitoring) — < 7.2
Weakness (CWE)
CWESourceDescription
— cna Missing Authentication Check
CWE-306 adp CWE-306 Missing Authentication for Critical Function
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.0 cna CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (7)
Back to overview