Vulnerability · Published Apr 11, 2023 · Assigned by sap

CVE-2023-27497Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)

Critical 10.0

In plain English

A critical-severity missing authentication in Diagnostics Agent (EventLogServiceCollector) from SAP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.8%top 44.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.

Affected products (as reported)

Vendor	Product	Versions
SAP	Diagnostics Agent (EventLogServiceCollector)	720

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References