PT-2020-4202 · Sap · Sap Host Agent

Published 2020-04-14 · Updated 2022-04-29 · CVE-2020-6234

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SAP Host Agent version 7.21

Description: The issue is related to insufficient access control in the SAP Host Agent, allowing a remote attacker to escalate privileges to the root level. This can be achieved by an attacker with admin privileges using the operation framework to gain root privileges over the underlying operating system.

Recommendations: For SAP Host Agent version 7.21, consider restricting access to the operation framework to prevent privilege escalation until a patch is available. As a temporary workaround, limit the use of admin privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-04636

CVE-2020-6234

Affected Products

Sap Host Agent

References · 8

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2902645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6234 · Security Note
• https://bdu.fstec.ru/vul/2020-04636 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6234 · Vendor Advisory
• http://packetstormsecurity.com/files/162084/SAP-Host-Control-Local-Privilege-Escalation.html · Note
• http://seclists.org/fulldisclosure/2021/Apr/5 · Note
• https://t.me/defcon_news/72987 · Telegram Post