Vulnerability · Published Mar 8, 2022 · Assigned by sap
CVE-2022-22547
High 7.5
In plain English
A high-severity information exposure in Simple Diagnostics Agent from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.5%top 15.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | Simple Diagnostics Agent | < =>1.0< 1.58 |
Weakness: CWE-200
References
- https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3147102 x_refsource_MISC
- 20220621 Onapsis Security Advisory 2022-0006: Information Disclosure vulnerability in SAP Focused Run (Simple Diagnostics Agent 1.0) mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/167562/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Information-Disclosure.html x_refsource_MISC