{"containers": {"cna": {"affected": [{"product": "SAP Focused Run (Simple Diagnostics Agent)", "vendor": "SAP SE", "versions": [{"status": "affected", "version": "< >= 1.0"}, {"status": "affected", "version": "< 1.58"}]}], "descriptions": [{"lang": "en", "value": "The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306, CWE-548", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-21T21:06:21", "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10"}, {"tags": ["x_refsource_MISC"], "url": "https://launchpad.support.sap.com/#/notes/3145987"}, {"name": "20220621 # Onapsis Security Advisory 2022-0004: Missing Authentication check in SAP Focused Run (Simple Diagnostics Agent 1.0)", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2022/Jun/38"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing-Authentication.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cna@sap.com", "ID": "CVE-2022-24396", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SAP Focused Run (Simple Diagnostics Agent)", "version": {"version_data": [{"version_name": "<", "version_value": ">= 1.0"}, {"version_name": "<", "version_value": "< 1.58"}]}}]}, "vendor_name": "SAP SE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations."}]}, "impact": {"cvss": {"baseScore": "null", "vectorString": "null", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-306, CWE-548"}]}]}, "references": {"reference_data": [{"name": "https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10", "refsource": "MISC", "url": "https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10"}, {"name": "https://launchpad.support.sap.com/#/notes/3145987", "refsource": "MISC", "url": "https://launchpad.support.sap.com/#/notes/3145987"}, {"name": "20220621 # Onapsis Security Advisory 2022-0004: Missing Authentication check in SAP Focused Run (Simple Diagnostics Agent 1.0)", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2022/Jun/38"}, {"name": "http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing-Authentication.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing-Authentication.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:07:02.528Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://launchpad.support.sap.com/#/notes/3145987"}, {"name": "20220621 # Onapsis Security Advisory 2022-0004: Missing Authentication check in SAP Focused Run (Simple Diagnostics Agent 1.0)", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2022/Jun/38"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing-Authentication.html"}]}]}, "cveMetadata": {"assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "assignerShortName": "sap", "cveId": "CVE-2022-24396", "datePublished": "2022-03-08T13:35:46", "dateReserved": "2022-02-03T00:00:00", "dateUpdated": "2024-08-03T04:07:02.528Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:simple_diagnostics_agent:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D15E1C0-4565-4829-B67C-BBDA7D2C8BFD", "versionEndIncluding": "1.57", "versionStartIncluding": "1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations."}, {"lang": "es", "value": "The Simple Diagnostics Agent - versiones 1.0 hasta 1.57, no lleva a cabo ninguna comprobaci\u00f3n de autenticaci\u00f3n para las funcionalidades a las que puede accederse por medio de localhost en el puerto http 3005. Debido a la falta de comprobaciones de autenticaci\u00f3n, un atacante podr\u00eda acceder a funcionalidades administrativas u otras privilegiadas y leer, modificar o eliminar informaci\u00f3n y configuraciones confidenciales"}], "id": "CVE-2022-24396", "lastModified": "2023-11-07T03:44:27.733", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-03-10T17:46:09.270", "references": [{"source": "cna@sap.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/167560/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Missing-Authentication.html"}, {"source": "cna@sap.com", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2022/Jun/38"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10"}, {"source": "cna@sap.com", "tags": ["Permissions Required", "Vendor Advisory"], "url": "https://launchpad.support.sap.com/#/notes/3145987"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "cna@sap.com", "type": "Primary"}]}

{}