Solution Manager
by SAP
CVEs (42)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-49587 | Med | 0.42 | 6.4 | 0.00 | Dec 12, 2023 | SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network. | ||
| CVE-2023-23855 | Med | 0.42 | 6.5 | 0.00 | Feb 14, 2023 | SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful attack could lead an attacker to read or modify the information or expose the user to a phishing attack. As a result, it… | ||
| CVE-2023-0025 | Med | 0.42 | 6.5 | 0.00 | Feb 14, 2023 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired… | ||
| CVE-2023-0024 | Med | 0.42 | 6.5 | 0.00 | Feb 14, 2023 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired… | ||
| CVE-2019-0293 | Med | 0.42 | 6.5 | 0.01 | May 14, 2019 | Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740). | ||
| CVE-2023-23852 | Med | 0.40 | 6.1 | 0.00 | Feb 14, 2023 | SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | ||
| CVE-2022-41275 | Med | 0.40 | 6.1 | 0.00 | Dec 13, 2022 | In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can be redirected to a malicious page that could read or modify sensitive information, or expose the user to a phishing… | ||
| CVE-2020-26836 | Med | 0.40 | 6.1 | 0.02 | Dec 9, 2020 | SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as… | ||
| CVE-2022-41261 | Med | 0.39 | 6.0 | 0.00 | Dec 12, 2022 | SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can be used to access a configuration file which contains credentials to access other system files. Successful exploitation… | ||
| CVE-2020-6369 | Med | 0.39 | 5.9 | 0.03 | Oct 20, 2020 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the authentication if the default passwords for Admin and Guest have not been changed by the administrator.This may impact the… | ||
| CVE-2019-0291 | Med | 0.36 | 5.5 | 0.00 | May 14, 2019 | Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted. | ||
| CVE-2020-6261 | Med | 0.35 | 5.3 | 0.01 | Jul 1, 2020 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The readability of the trace file is impaired. | ||
| CVE-2020-6260 | Med | 0.35 | 5.3 | 0.01 | Jun 10, 2020 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist. | ||
| CVE-2018-2405 | Med | 0.35 | 5.4 | 0.01 | Apr 10, 2018 | SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting. | ||
| CVE-2021-21483 | Med | 0.32 | 4.9 | 0.01 | Apr 13, 2021 | Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct serious impact beyond the exploitable component thereby affecting the confidentiality in the application. | ||
| CVE-2025-30017 | Med | 0.29 | 4.4 | 0.00 | Apr 8, 2025 | Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application. | ||
| CVE-2019-0307 | Low | 0.19 | 2.4 | 0.02 | Jun 12, 2019 | Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges… | ||
| CVE-2014-5175 | 0.00 | — | 0.02 | Jul 31, 2014 | The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS. | |||
| CVE-2014-3132 | 0.00 | — | 0.01 | Apr 30, 2014 | SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1. | |||
| CVE-2014-3129 | 0.00 | — | 0.02 | Apr 30, 2014 | The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1. |
- risk 0.42cvss 6.4epss 0.00
SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network.
- risk 0.42cvss 6.5epss 0.00
SAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validation. A successful attack could lead an attacker to read or modify the information or expose the user to a phishing attack. As a result, it…
- risk 0.42cvss 6.5epss 0.00
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired…
- risk 0.42cvss 6.5epss 0.00
SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired…
- risk 0.42cvss 6.5epss 0.01
Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740).
- risk 0.40cvss 6.1epss 0.00
SAP Solution Manager (System Monitoring) - version 720, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- risk 0.40cvss 6.1epss 0.00
In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can be redirected to a malicious page that could read or modify sensitive information, or expose the user to a phishing…
- risk 0.40cvss 6.1epss 0.02
SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as…
- risk 0.39cvss 6.0epss 0.00
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can be used to access a configuration file which contains credentials to access other system files. Successful exploitation…
- risk 0.39cvss 5.9epss 0.03
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the authentication if the default passwords for Admin and Guest have not been changed by the administrator.This may impact the…
- risk 0.36cvss 5.5epss 0.00
Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted.
- risk 0.35cvss 5.3epss 0.01
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The readability of the trace file is impaired.
- risk 0.35cvss 5.3epss 0.01
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist.
- risk 0.35cvss 5.4epss 0.01
SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possible Cross-Site Scripting.
- risk 0.32cvss 4.9epss 0.01
Under certain conditions SAP Solution Manager, version - 720, allows a high privileged attacker to get access to sensitive information which has a direct serious impact beyond the exploitable component thereby affecting the confidentiality in the application.
- risk 0.29cvss 4.4epss 0.00
Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application.
- risk 0.19cvss 2.4epss 0.02
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges…
- CVE-2014-5175Jul 31, 2014risk 0.00cvss —epss 0.02
The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.
- CVE-2014-3132Apr 30, 2014risk 0.00cvss —epss 0.01
SAP Background Processing does not properly restrict access, which allows remote authenticated users to obtain sensitive information via an unspecified RFC function, related to SAP Solution Manager 7.1.
- CVE-2014-3129Apr 30, 2014risk 0.00cvss —epss 0.02
The Java Server Pages in the Software Lifecycle Manager (SLM) in SAP NetWeaver allows remote attackers to obtain sensitive information via a crafted request, related to SAP Solution Manager 7.1.
Page 2 of 3