Read the docs
TI-2022-10638 Aliases CVE-2022-27657GHSA-vr5w-v4j5-6636

Path traversal in SAP Focused Run

Priority LOW 18CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run (Simple Diagnostics Agent 1.0) - version 1.0.

Why it matters now

EPSS 0.02514 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP Focused Run (Simple Diagnostics Agent)1.0—No fix listedCNA
  • SAP Focused Run (Simple Diagnostics Agent) VendorSAP Affected 1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sap:focused_run:1.0:*:*:*:*:*:*:*1.0VulnerableSAP
  • cpe:2.3:a:sap:focused_run:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27657
  2. 2026-10-03 Alias added: GHSA-vr5w-v4j5-6636

References

Advisory 4

  • TI-2020-05220 SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7… CVSS 3.1MEDIUM 5.9
  • TI-2022-08275 Cross-site scripting in SAP Focused Run CVSS 3.1MEDIUM 6.1
  • TI-2021-09061 Missing authorization in SAP Focused RUN CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences