Medium severity · published Dec 12, 2023
CVE-2023-49587
Command Injection vulnerability in SAP Solution Manager
6.4
CVSS
0.4%
EPSS
No
On KEV
Description
SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which can read or modify data of same or other component without user interaction over the network.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
SAP Solution Manager · SAP_SE
720 · source: vendor
SM
Solution Manager · Sap
720 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49587
Permissions Required
https://me.sap.com/notes/3395306
Vendor Advisory
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
More from SAP Solution Manager
9.9
CVE-2025-42880
Code Injection vulnerability in SAP Solution Manager
9.9
CVE-2025-42887
Code Injection vulnerability in SAP Solution Manager
4.4
CVE-2025-30017
Missing Authorization check in SAP Solution Manager