Input validation error in SAP Diagnostics Agent - CVE-2023-27497
Published: April 14, 2023
Vulnerability identifier: #VU75122
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-27497
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in the EventLogServiceCollector. A remote attacker can pass specially crafted input to the application and execute malicious scripts on all connected Diagnostics Agents running on Windows.
Affected software
SAP Diagnostics Agent
How to mitigate CVE-2023-27497
Install updates from vendor's website.