{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2021-004.pdf"
    },
    "title": "Critical Vulnerability in SAP Solution Manager",
    "serial_number": "2021-004",
    "publish_date": "22-01-2021 13:30:00",
    "description": "On the 10th of March 2020, SAP released several patches for their products. One of them fixes a critical vulnerability in SAP Solution Manager - User-Experience Monitoring. This vulnerability could lead to remote code execution on every system connected to the Solution Manager. Last week, a proof-of-concept has been publicly released, thus increasing the compromise possibility. Applying the patch is highly recommended.",
    "url_title": "2021-004",
    "content_markdown": "---\ntitle: 'Critical Vulnerability in\u00a0SAP\u00a0Solution\u00a0Manager'\nversion: '1.0'\nnumber: '2021-004'\ndate: 'January 22, 2021'\n---\n\n_History:_\n\n* _22/01/2021 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn the 10th of March 2020, SAP released several patches for their products. One of them fixes a critical vulnerability in SAP Solution Manager - User-Experience Monitoring. This vulnerability could lead to **remote code execution** on **every system connected to the Solution Manager** [1]. Last week, a proof-of-concept has been publicly released [2], thus increasing the compromise possibility. Applying the patch is highly recommended.\n\n# Technical Details\n\nIdentified by **CVE-2020-6207**, this vulnerability is due to missing authentication checks. A **remote, unauthenticated** attacker could exploit this weakness to deploy and execute scripts and operating system commands on all SMDAgents connected to the Solution Manager [3].\n\n# Affected products\n\nThe following product is affected by the vulnerability:\n\n* SAP Solution Manager 7.2\n\n# Recommendations\n\nIt is recommended to apply the patches from SAP for all servers.\n\n# References\n\n[1] <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6207>\n\n[2] <https://www.zdnet.com/article/automated-exploit-of-critical-sap-solman-vulnerability-detected-in-the-wild/>\n\n[3] <https://onapsis.com/blog/new-sap-exploit-published-online-how-stay-secure>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>22/01/2021 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On the 10th of March 2020, SAP released several patches for their products. One of them fixes a critical vulnerability in SAP Solution Manager - User-Experience Monitoring. This vulnerability could lead to <strong>remote code execution</strong> on <strong>every system connected to the Solution Manager</strong> [1]. Last week, a proof-of-concept has been publicly released [2], thus increasing the compromise possibility. Applying the patch is highly recommended.</p><h2 id=\"technical-details\">Technical Details</h2><p>Identified by <strong>CVE-2020-6207</strong>, this vulnerability is due to missing authentication checks. A <strong>remote, unauthenticated</strong> attacker could exploit this weakness to deploy and execute scripts and operating system commands on all SMDAgents connected to the Solution Manager [3].</p><h2 id=\"affected-products\">Affected products</h2><p>The following product is affected by the vulnerability:</p><ul><li>SAP Solution Manager 7.2</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>It is recommended to apply the patches from SAP for all servers.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6207\">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6207</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.zdnet.com/article/automated-exploit-of-critical-sap-solman-vulnerability-detected-in-the-wild/\">https://www.zdnet.com/article/automated-exploit-of-critical-sap-solman-vulnerability-detected-in-the-wild/</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://onapsis.com/blog/new-sap-exploit-published-online-how-stay-secure\">https://onapsis.com/blog/new-sap-exploit-published-online-how-stay-secure</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}