Vulnerability · Published Apr 11, 2023 · Assigned by sap

CVE-2023-27267Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)

Critical 9.0

In plain English

A critical-severity missing authentication in Diagnostics Agent (OSCommand Bridge) from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 14.2% (higher than 97% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)14.2%top 3.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.

Affected products (as reported)

Vendor	Product	Versions
SAP	Diagnostics Agent (OSCommand Bridge)	720

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References