CVE-2023-24523: sap host_agent Exposure of Resource to Wrong Sphere

Vulnerability summary

CVE-2023-24523 is a high (CVSS 8.8) Exposure of Resource to Wrong Sphere vulnerability in sap host_agent. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.6% of scored vulnerabilities.

Timeline

1. 14-02-2023
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery request with an operating system command which will be executed with administrator privileges.  The OS command can read or modify any user or system data and can make the system unavailable.

• CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.