Lucene search

[email protected]CVE-2020-6369

HistoryOct 20, 2020 - 2:15 p.m.

CVE-2020-6369

2020-10-2014:15:14

[email protected]

web.nvd.nist.gov

cve-2020-6369

sap solution manager

sap focused run

authentication bypass

default passwords

confidentiality

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.7%

JSON

SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the authentication if the default passwords for Admin and Guest have not been changed by the administrator.This may impact the confidentiality of the service.

Affected configurations

NVD

Node

sapfocused_runMatch9.7

sapfocused_runMatch10.1

sapfocused_runMatch10.5

sapfocused_runMatch10.7

sapsolution_managerMatch9.7

sapsolution_managerMatch10.1

sapsolution_managerMatch10.5

sapsolution_managerMatch10.7

CPENameOperatorVersion
sap:focused_runsap focused runeq9.7
sap:focused_runsap focused runeq10.1
sap:focused_runsap focused runeq10.5
sap:focused_runsap focused runeq10.7
sap:solution_managersap solution managereq9.7
sap:solution_managersap solution managereq10.1
sap:solution_managersap solution managereq10.5
sap:solution_managersap solution managereq10.7

CPE	Name	Operator	Version
sap:focused_run	sap focused run	eq	9.7
sap:focused_run	sap focused run	eq	10.1
sap:focused_run	sap focused run	eq	10.5
sap:focused_run	sap focused run	eq	10.7
sap:solution_manager	sap solution manager	eq	9.7
sap:solution_manager	sap solution manager	eq	10.1
sap:solution_manager	sap solution manager	eq	10.5
sap:solution_manager	sap solution manager	eq	10.7

CNA Affected

[
  {
    "product": "CA Introscope Enterprise Manager (Affected products: SAP Solution Manager and SAP Focused Run)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 9.7"
      },
      {
        "status": "affected",
        "version": "< 10.1"
      },
      {
        "status": "affected",
        "version": "< 10.5"
      },
      {
        "status": "affected",
        "version": "< 10.7"
      }
    ]
  }
]

References

packetstormsecurity.com/files/163159/SAP-Wily-Introscope-Enterprise-Default-Hard-Coded-Credentials.html

seclists.org/fulldisclosure/2021/Jun/31

launchpad.support.sap.com/#/notes/2971638

wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.7%

JSON

Related for CVE-2020-6369

nvd1 prion1 cvelist1