Vulnerability · Published Mar 8, 2022 · Assigned by sap
CVE-2022-24396
High 7.8
In plain English
A high-severity missing authentication in SAP Focused Run (Simple Diagnostics Agent) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Focused Run (Simple Diagnostics Agent) | < >= 1.0< 1.58 |
Weakness: CWE-306
References
- https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3145987 x_refsource_MISC
- 20220621 # Onapsis Security Advisory 2022-0004: Missing Authentication check in SAP Focused Run (Simple Diagnostics Agent 1.0) mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing-Authentication.html x_refsource_MISC