Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2023-24523

An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted Configur

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery request with an operating system command which will be executed with administrator privileges.  The OS command can read or modify any user or system data and can make the system unavailable.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP Host Agent Service

Default version status: unaffected

  • 7.21affected
  • 7.22affected

References