Input validation error in SAP Diagnostics Agent - CVE-2023-27267
Published: April 14, 2023
Vulnerability identifier: #VU75123
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-27267
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in the OSCommand Bridge. A remote attacker can pass specially crafted input to the application and execute malicious scripts on all connected Diagnostics Agents running on Windows.
Affected software
SAP Diagnostics Agent
How to mitigate CVE-2023-27267
Install updates from vendor's website.