What is CVE-2022-22544?

CVE-2022-22544 is a critical-severity vulnerability in SAP Solution Manager. CVSS score: 9.1/10. Published 2022-02-09.

How severe is CVE-2022-22544?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in SAP Solution Manager

CVE-2022-22544

Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse files on their systems. An attacker could thereby control the managed systems. It is considered that this is a missing segregation of duty for the SAP Solution Manager administrator. Impacts of unauthorized execution of commands can lead to sensitive information disclosure, loss of system integrity and denial of service.

EPSS: 0.014 (69.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Sap Solution_manager — versions 7.20
Sap Se Solution Manager (Diagnostics Root Cause Analysis Tools) — versions 720

References

cna@sap.com (Permissions Required, x_refsource_MISC, Vendor Advisory)
cna@sap.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-22544?: CVE-2022-22544 is a critical-severity vulnerability in SAP Solution Manager. CVSS score: 9.1/10. Published 2022-02-09.
How severe is CVE-2022-22544?: Critical severity. CVSS v3 base score is 9.1 out of 10.