PT-2019-3771 · Sap · Sap Diagnostic Agent

Published 2019-07-10 · Updated 2023-12-19 · CVE-2019-0330

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Diagnostic Agent version 7.2

Description The issue exists due to the failure to neutralize special elements used in the operating system command. This allows a remote attacker to inject code that can be executed by the application, potentially controlling the application's behavior. The vulnerability is related to the OS Command Plugin in the transaction GPA ADMIN and the OSCommand Console of the SAP Diagnostic Agent.

Recommendations For SAP Diagnostic Agent version 7.2, update to a version that includes a fix for this issue to prevent code injection and potential control of the application's behavior. As a temporary workaround, consider restricting access to the OSCommand Console and the GPA ADMIN transaction to minimize the risk of exploitation.

Fix

OS Command Injection

Code Injection

Weakness Enumeration

CWE-78

CWE-94

Related Identifiers

BDU:2019-04064

CVE-2019-0330

Affected Products

Sap Diagnostic Agent

References · 8

• https://bdu.fstec.ru/vul/2019-04064 · Security Note
• https://launchpad.support.sap.com/#/notes/2808158 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523994575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0330 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0330 · Vendor Advisory
• http://securityfocus.com/bid/109068 · Note
• https://threatpost.ru/sap-july-patches-for-diagnostic-agent-other-cloud-systems/33481 · Note
• https://t.me/cvenotify/64162 · Telegram Post