CVE-2023-27267

CWE-306 — Missing Authentication3 documents3 sources
Severity
8.1HIGH
EPSS
8.4%
top 7.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP Diagnostics Agent (oscommand Bridge)SAP Diagnostics Agent
Timeline
PublishedApr 11
Latest updateJul 6

Description

Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 2.2 | Impact: 6.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-f5c7-p8w5-6jv3: Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with↗2023-07-06
▶
CVEList
Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)↗2023-04-11
▶
CVE-2023-27267 (HIGH CVSS 8.1) | Due to missing authentication and i | cvebase.io