Skip to content
COOEY

EXPOSURES › CVE-2020-6207

CVE-2020-6207

HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2021-11-03 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2020-6207 ↗
⌖ EXPLOITED IN THE WILD SHAME 78/100 exploited-in-wildunpatched

SAP Solution Manager's missing authentication for critical functions allowed complete compromise of all connected SMDAgents.

SAP Solution Manager lacked authentication for critical functions in its User Experience Monitoring, enabling attackers to fully compromise all connected SMDAgents. DIB organizations must ensure missing authentication vulnerabilities are patched immediately, as they can lead to complete system compromise and violate CMMC/NIST 800-171 requirements for protecting unclassified information.

Shame score — Missing authentication for critical functions is a severe, avoidable design flaw that allows complete system compromise, fitting high embarrassment for negligent, reputation-shredding failures.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED
SAP · vendorSolution Manager · product
DESCRIPTION

SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.

SENTIMENT · TRUSTED SOURCES
synthesis severe-fallout -0.60
SAP's vulnerability in Solution Manager allowed full compromise of connected agents due to missing authentication, representing a severe security failure.
cooey ↗ severe-fallout -0.80
NVD describes the vulnerability as resulting in complete compromise of all connected SMDAgents, indicating severe fallout.
"SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager."
AFFECTED FEDRAMP PRODUCTS · 2
PRODUCTSTATUS
SAP NS2 Cloud Intelligent Enterprise
SAP National Security Services Inc. (SAP NS2)
 Authorized
SAP NS2 Secure Node with SuccessFactors Suite - DoD
SAP National Security Services Inc. (SAP NS2)
 Authorized