Back
CVE-2020-6364
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a…
Critical10.0EPSS 6.4%
- Published
- Updated
- Reserved
- Assigned by
- sap
Description
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager,leading to Code Injection. With this, the attacker is able to read and modify all system files and also impact system availability.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| sapCNA (assigner) | 3.0 | Critical10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 6.4% · top 6.3% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.
Weakness
- Code Injection
- CWE-78 (opens in a new tab)All about CWE-78 and its CVEs
Affected products
SAP SE · SAP Solution Manager (CA Introscope Enterprise Manager) and SAP Focused Run (CA Introscope Enterprise Manager)
- affected < WILY_INTRO_ENTERPRISE 9.7
- affected < 10.1
- affected < 10.5
- affected < 10.7
References (4)
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 (opens in a new tab)x_refsource_MISCx_transferred
- https://launchpad.support.sap.com/#/notes/2969828 (opens in a new tab)x_refsource_MISCx_transferred
- 20210614 Onapsis Security Advisory 2021-0008: OS Command Injection in CA Introscope Enterprise Manager (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- http://packetstormsecurity.com/files/163153/SAP-Wily-Introscope-Enterprise-OS-Command-Injection.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-6364)Record last updated .