SAP Focused Run vulnerabilities

4 CVEs affecting SAP Focused Run, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-27657, published 2022-04-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-6369, published 2020-10-20. Medium severity, CVSS 5.9. EPSS: 2.7% chance of exploitation in the next 30 days. SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the authentication if the default passwords…
CVE-2022-27657, published 2022-04-12. Low severity, CVSS 2.7. EPSS: 2.5% chance of exploitation in the next 30 days. A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run (Simple…
CVE-2022-24399, published 2022-03-10. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. The SAP Focused Run (Real User Monitoring) - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-data, resulting in Cross-Site Scripting…
CVE-2021-27609, published 2021-04-13. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call the oData service and manipulate the activation for the SAP…