CVE-2020-6207

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

• CWE-306
• CWE-306

• http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-Missing-Authorization.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Apr/4Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Jun/34Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2890213Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305Broken Link, Vendor Advisory
• http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-Missing-Authorization.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Apr/4Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Jun/34Mailing List, Third Party Advisory
• https://launchpad.support.sap.com/#/notes/2890213Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305Broken Link, Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6207US Government Resource

Published

Mar 10, 2020

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6201The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 18…6.1
• CVE-2020-6202SAP NetWeaver Application Server Java (User Management Engin…7.2
• CVE-2020-6203SAP NetWeaver UDDI Server (Services Registry), versions- 7.1…9.1
• CVE-2020-6204The selection query in SAP Treasury and Risk Management (Tra…4.3
• CVE-2020-6205SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), S…6.1
• CVE-2020-6206SAP Cloud Platform Integration for Data Services, version 1.…4.3
• CVE-2020-6208SAP Business Objects Business Intelligence Platform (Crystal…8.2
• CVE-2020-6209SAP Disclosure Management, version 10.1, does not perform ne…7.5
• CVE-2020-6210SAP Fiori Launchpad, versions- 753, 754, does not sufficient…6.1
• CVE-2020-6211SAP Business Objects Business Intelligence Platform (AdminTo…6.1
• CVE-2020-6212Egypt localized withholding tax reports Clearing of Liabilit…5.4
• CVE-2020-6213SAP NetWeaver AS ABAP Business Server Pages Test Application…6.1