PT-2020-18986 · Sap · Sap Host Agent

Published 2020-02-12 · Updated 2020-02-20 · CVE-2020-6183

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Host Agent version 7.21

Description The issue allows an unprivileged user to read or write to the shared memory by sending a request to the main SAPOSCOL process. This can lead to the user receiving responses that contain data read with root privileges, such as the size of any directory, system hardware, and OS details, due to a Missing Authorization Check.

Recommendations For SAP Host Agent version 7.21, consider restricting access to the shared memory to prevent unauthorized reads or writes until a patch is available. As a temporary workaround, limit the information that can be accessed through the SAPOSCOL process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-6183

Affected Products

Sap Host Agent

References · 5

• https://launchpad.support.sap.com/#/notes/2836445 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6183 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6183 · Security Note
• https://t.me/cvenotify/955 · Telegram Post