Information disclosure vulnerability in SAP Host Agent
CVE-2023-36926

3.7LOW

Key Information:

Vendor
SAP
Status
SAP Host Agent
Vendor
CVE Published:
8 August 2023

Summary

Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather some non-sensitive information about the server.  There is no impact on integrity or availability.

Affected Version(s)

SAP Host Agent 7.22

References

https://me.sap.com/notes/3358328
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-...

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.