PT-2023-4215 · Sap · Sap Host Agent

Published 2023-08-08 · Updated 2024-09-26 · CVE-2023-36926

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Host Agent version 7.22

Description The issue is related to a missing authentication check in the SAP Host Agent, allowing an unauthenticated attacker to set an undocumented parameter to a particular compatibility value. This enables the attacker to call read functions and gather some non-sensitive information about the server. There is no impact on the server's integrity or availability.

Recommendations For SAP Host Agent version 7.22, consider implementing additional authentication checks to prevent unauthorized access until a patch is available. As a temporary workaround, restrict access to the read functions to minimize the risk of exploitation.

Fix

Missing Authentication

Improper Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-287

CWE-200

Related Identifiers

BDU:2023-04530

CVE-2023-36926

Affected Products

Sap Host Agent

References · 9

• https://osv.dev/vulnerability/CVE-2023-36926 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04530 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36926 · Security Note
• https://me.sap.com/notes/3358328 · Note
• https://t.me/cibsecurity/67946 · Telegram Post
• https://vuldb.com/?id.236339 · Note
• https://t.me/cvenotify/96221 · Telegram Post
• https://blogs.sap.com/2023/08/08/sap-security-patch-day-august-2023 · Note