PT-2023-15947 · Sap · Sap Host Agent

Published 2023-01-10 · Updated 2023-01-13 · CVE-2023-0012

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Host Agent (Windows) versions 7.21, 7.22

Description An attacker who gains local membership to SAP LocalAdmin could replace executables with a malicious file that will be started under a privileged account. This can only occur if the system has already been compromised, as by default, all user members of SAP LocalAdmin are denied the ability to logon locally by security policy.

Recommendations For versions 7.21 and 7.22, consider restricting access to the SAP LocalAdmin group to minimize the risk of exploitation, as this vulnerability can be exploited if an attacker gains local membership to this group. Additionally, review security policies to ensure that the default denial of local logon for SAP LocalAdmin members is enforced. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-0012

Affected Products

Sap Host Agent

References · 7

• https://launchpad.support.sap.com/#/notes/3276120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0012 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0012 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://t.me/cibsecurity/56217 · Telegram Post
• https://t.me/cvenotify/41671 · Telegram Post
• https://t.me/cvenotify/41946 · Telegram Post