CVE-2020-6364

published 2020-10-15

CVE-2020-6364: SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that…

Priority P2 69 critical 10 CVSS 3.1

AV N AC L PR N UI N S C C H I H A H

SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
sap	introscope_enterprise_manager	—	—
sap	introscope_enterprise_manager	—	—
sap	introscope_enterprise_manager	—	—
sap	introscope_enterprise_manager	—	—
sap_se	sap_solution_manager_and_sap_focused_run	< WILY_INTRO_ENTERPRISE 9.7	WILY_INTRO_ENTERPRISE 9.7
sap_se	sap_solution_manager_and_sap_focused_run	< 10.1	10.1
sap_se	sap_solution_manager_and_sap_focused_run	< 10.5	10.5
sap_se	sap_solution_manager_and_sap_focused_run	< 10.7	10.7

CVSS provenance

nvd v3.1 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvd v3.0 10.0 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78