PT-2023-4099 · Sap · Sap Solution Manager

Publicado 2023-07-11 · Atualizado 2023-07-27 · CVE-2023-36921

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions SAP Solution Manager (Diagnostics agent) version 7.20

Description The issue is related to a lack of output encoding or escaping mechanism in the SAP Solution Manager (Diagnostics agent) platform. This can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability allows an attacker to tamper with headers in a client request, misleading the SAP Diagnostics Agent to serve poisoned content to the server, which can impact the confidentiality and availability of the application.

Recommendations For SAP Solution Manager (Diagnostics agent) version 7.20, update the software to a version that includes a fix for the output encoding or escaping mechanism issue to prevent cross-site scripting (XSS) attacks.

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-644

CWE-116

Identificadores relacionados

BDU:2023-04407

CVE-2023-36921

Produtos afetados

Sap Solution Manager

Referências · 6

• https://bdu.fstec.ru/vul/2023-04407 · Nota de Segurança
• https://me.sap.com/notes/3348145 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-36921 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023072757 · Nota
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-36921 · Aviso do Fabricante