Vulnerability · Published Sep 13, 2022 · Assigned by sap
CVE-2022-35295
Medium 4.9
In plain English
A medium-severity security flaw in SAP Host Agent (SAPOSCOL) from SAP SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS NVD)4.9Medium
Exploit odds (30 days)1.7%top 22.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP Host Agent (SAPOSCOL) | 7.22 |
Weakness: CWE-755
References
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
- https://launchpad.support.sap.com/#/notes/3159736
- 20221213 SEC Consult SA-20221213-0 :: Privilege Escalation Vulnerabilities (UNIX Insecure File Handling) in SAP Host Agent (saposcol) mailing-list
- http://packetstormsecurity.com/files/170233/SAP-Host-Agent-Privilege-Escalation.html