Vulnerability · Published Dec 9, 2020 · Assigned by sap

CVE-2020-26830

High 7.6

In plain English

A high-severity security flaw in SAP Solution Manager (User Experience Monitoring) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.0)7.6High

Exploit odds (30 days)1.5%top 26.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. These operations can be used to Change the User Experience Monitoring configuration, obtain details about the configured SAP Solution Manager agents, Deploy a malicious User Experience Monitoring script.

Affected products (as reported)

Vendor	Product	Versions
SAP SE	SAP Solution Manager (User Experience Monitoring)	< 7.20

References

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079 x_refsource_MISC
https://launchpad.support.sap.com/#/notes/2983204 x_refsource_MISC
20210614 Onapsis Security Advisory 2021-0011 Missing authorization check in SolMan End-User Experience Monitoring mailing-list, x_refsource_FULLDISC
http://packetstormsecurity.com/files/163161/SAP-Solution-Manager-7.2-Missing-Authorization.html x_refsource_MISC