PT-2020-18994 · Sap · Sap Host Agent+1

Published 2020-02-12 · Updated 2020-02-19 · CVE-2020-6191

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Landscape Management version 3.0

Description The issue allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation.

Recommendations For SAP Landscape Management version 3.0, consider restricting access to the SAP Host Agent to minimize the risk of exploitation until a fix is available. As a temporary workaround, limit the execution of executables with root privileges to only those that are necessary for system operation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-6191

Affected Products

Sap Host Agent

Sap Landscape Management

References · 5

• https://launchpad.support.sap.com/#/notes/2878030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6191 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6191 · Vendor Advisory
• https://t.me/cvenotify/963 · Telegram Post