The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing-Authentication.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2022/Jun/38 | Exploit Mailing List Third Party Advisory |
| https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 | Vendor Advisory |
| https://launchpad.support.sap.com/#/notes/3145987 | Permissions Required Vendor Advisory |
Configurations
History
21 Jun 2022, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Jun 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Mar 2022, 15:21
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://launchpad.support.sap.com/#/notes/3145987 - Permissions Required, Vendor Advisory | |
| References | (MISC) https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 7.2
v3 : 7.8 |
| CPE | cpe:2.3:a:sap:simple_diagnostics_agent:*:*:*:*:*:*:*:* |
10 Mar 2022, 17:53
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-10 17:46
Updated : 2024-02-04 22:29
NVD link : CVE-2022-24396
Mitre link : CVE-2022-24396
CVE.ORG link : CVE-2022-24396
JSON object : View
Products Affected
sap
- simple_diagnostics_agent
CWE
CWE-306
Missing Authentication for Critical Function