CVE-2020-6207: SAP Solution Manager Missing Authentication for Critical Function Vulnerability

Vulnerability summary

CVE-2020-6207 is a critical (CVSS 10.0) vulnerability in SAP Solution Manager. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 98.13% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 10-03-2020
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVSAP Solution Manager Missing Authentication for Critical Function Vulnerability
3. 03-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.