CVE-2023-36925: sap_se sap solution manager (diagnostics agent) Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2023-36925 is a high (CVSS 7.2) Server-Side Request Forgery (SSRF) vulnerability in sap_se sap solution manager (diagnostics agent). EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities.

Timeline

1. 11-07-2023
   PublishedVulnerability first disclosed.
2. 12-11-2024
   Last modifiedVulnerability information updated.

Description

SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application and other applications the Diagnostics Agent can reach.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.