CVE-2022-22544 Missing authorization in SAP Solution Manager (Diagnostics Root Cause Analysis Tools)

Critical 9.1 Published 9 Feb 2022 Updated 3 Aug 2024

An attacker with administrator access can execute code and browse files on connected Diagnostics Agents, leading to system control and data exposure.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-22544?

CVE-2022-22544 is a critical missing authorization vulnerability in SAP Solution Manager (Diagnostics Root Cause Analysis Tools), published on 9 Feb 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all connected Diagnostics Agents and browse files on their systems. An attacker could thereby control the managed systems. It is considered that this is a missing segregation of duty for the SAP Solution Manager administrator. Impacts of unauthorized execution of commands can lead to sensitive information disclosure, loss of system integrity and denial of service.

Which versions are affected by CVE-2022-22544?

It affects 1 product.

Products include Sap Solution Manager.

How do I fix CVE-2022-22544?

No fix has been published for CVE-2022-22544 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-22544 being exploited?

There is no known exploitation of CVE-2022-22544 in the wild and no public exploit code.

Sources

Also known as GHSA-fm4v-rfjh-p9cc.