PT-2023-2328 · Sap · Sap Diagnostic Agent

Published 2023-04-10 · Updated 2023-04-14 · CVE-2023-27267

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Diagnostics Agent version 720

Description The issue is related to missing authentication and insufficient input validation in the OSCommand Bridge of the SAP Diagnostics Agent. This allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents, potentially compromising confidentiality, integrity, and availability of the system.

Recommendations For SAP Diagnostics Agent version 720, consider disabling the OSCommand Bridge function until a patch is available to prevent exploitation. Restrict access to the Diagnostics Agent to minimize the risk of unauthorized script execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-02093

CVE-2023-27267

Affected Products

Sap Diagnostic Agent

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-27267 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27267 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02093 · Security Note
• https://t.me/cibsecurity/61824 · Telegram Post
• https://t.me/cvenotify/47975 · Telegram Post
• https://t.me/true_secator/4281 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3305369 · Note