CVE-2022-24396

The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations.

Affected

SAP SE · SAP Focused Run (Simple Diagnostics Agent)

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.52% chance of exploitation in the next 30 days, 43rd percentile

Published

2022-03-08

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing…
• http://seclists.org/fulldisclosure/2022/Jun/38

Security advisories

• https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
• https://launchpad.support.sap.com/#/notes/3145987

References

• CVE Record
• NVD entry