CVE-2023-27497

CWE-306 — Missing Authentication3 documents3 sources
Severity
9.8CRITICAL
EPSS
0.3%
top 43.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP Diagnostics Agent (eventlogservicecollector)SAP Diagnostics Agent
Timeline
PublishedApr 11

Description

Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-h9h4-rp86-rvq6: Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker t↗2023-04-11
▶
CVEList
Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)↗2023-04-11
▶
CVE-2023-27497 (CRITICAL CVSS 9.8) | Due to missing authentication and i | cvebase.io