PT-2023-4099 · Sap · Sap Solution Manager

Published 2023-07-11 · Updated 2023-07-27 · CVE-2023-36921

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions SAP Solution Manager (Diagnostics agent) version 7.20

Description The issue is related to a lack of output encoding or escaping mechanism in the SAP Solution Manager (Diagnostics agent) platform. This can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability allows an attacker to tamper with headers in a client request, misleading the SAP Diagnostics Agent to serve poisoned content to the server, which can impact the confidentiality and availability of the application.

Recommendations For SAP Solution Manager (Diagnostics agent) version 7.20, update the software to a version that includes a fix for the output encoding or escaping mechanism issue to prevent cross-site scripting (XSS) attacks.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-644

CWE-116

Related Identifiers

BDU:2023-04407

CVE-2023-36921

Affected Products

Sap Solution Manager

References · 6

• https://bdu.fstec.ru/vul/2023-04407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36921 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36921 · Vendor Advisory
• https://me.sap.com/notes/3348145 · Note
• https://cybersecurity-help.cz/vdb/SB2023072757 · Note