Vulnerability · Published Dec 12, 2022 · Assigned by sap
CVE-2022-41261
Medium 6.0
In plain English
A medium-severity improper access control in Solution Manager (Diagnostic Agent) from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can be used to access a configuration file which contains credentials to access other system files. Successful exploitation can make the attacker access files and systems for which he/she is not authorized.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP | Solution Manager (Diagnostic Agent) | 7.20 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N