CVE-2022-41261 Information disclosure in Solution Manager (Diagnostic Agent)
An authenticated attacker can access sensitive files to obtain credentials, enabling unauthorized access to other system files and data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-41261?
CVE-2022-41261 is a medium-severity vulnerability in SAP Solution Manager (Diagnostic Agent), published on 12 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can be used to access a configuration file which contains credentials to access other system files. Successful exploitation can make the attacker access files and systems for which he/she is not authorized.
Weakness: CWE-284
Which versions are affected by CVE-2022-41261?
It affects 1 product.
Products include Sap Solution Manager.
How do I fix CVE-2022-41261?
No fix has been published for CVE-2022-41261 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-41261 being exploited?
There is no known exploitation of CVE-2022-41261 in the wild and no public exploit code.
Other vulnerabilities in SAP Solution Manager (Diagnostic Agent)
- CVE-2020-6207 SAP Solution Manager Missing Authentication for Critical Function
- CVE-2020-26821 Missing authorization in SAP Solution Manager (JAVA stack)
- CVE-2020-26822 Missing authorization in SAP Solution Manager (JAVA stack)
- CVE-2020-26823 Missing authorization in SAP Solution Manager (JAVA stack)
- CVE-2020-26824 Missing authorization in SAP Solution Manager (JAVA stack)
Sources
Also known as GHSA-9g32-7v2h-hj2x.