Gonzalo Roisman

The issue arises from inadequate access control, allowing a network attacker authenticated as a regular user to perform operations restricted to administrators. This includes changing the User Experience Monitoring configuration, obtaining details about configured SAP Solution Manager agents, and deploying a malicious User Experience Monitoring script.

The issue allows an authenticated user to upload a malicious script that can exploit an existing path traversal vulnerability. This can compromise confidentiality by exposing elements of the file system, partially compromise integrity by allowing the modification of some configurations, and partially compromise availability by making certain services unavailable.