title: Command Injection vulnerability in SAP Solution Manager
description: SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network.
problem types: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
affected:
{
defaultStatus: unaffected
product: SAP Solution Manager
vendor: SAP_SE
versions:
status: affected, version: 720
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL