PT-2023-21172 · Sap · Sap Diagnostic Agent

Published 2023-04-11 · Updated 2023-04-18 · CVE-2023-27497

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Diagnostics Agent version 720

Description The EventLogServiceCollector of SAP Diagnostics Agent is affected by missing authentication and input sanitization of code, allowing an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. Successful exploitation can completely compromise confidentiality, integrity, and availability of the system.

Recommendations For SAP Diagnostics Agent version 720, consider disabling the EventLogServiceCollector until a patch is available to prevent exploitation. Restrict access to the Diagnostics Agents to minimize the risk of malicious script execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-27497

Affected Products

Sap Diagnostic Agent

References · 7

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27497 · Security Note
• https://t.me/cvenotify/47974 · Telegram Post
• https://t.me/pentestingnews/34901 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3305369 · Note
• https://t.me/cibsecurity/61825 · Telegram Post